3d621f9e9c5798699a93d9c5df358c66338e5216dad97867533de8fd6f01bf98

Analysis

user interaction
yes
max time kernel
598s
max time network
564s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/09/2026, 14:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AR Difusión S.L..pdf
Size 81KB
Sample260928-r4ycmsxvbx
SHA256 3d621f9e9c5798699a93d9c5df358c66338e5216dad97867533de8fd6f01bf98
MD5 20e727f0a3b23815a27ec2411b712e66
SHA1 88ceab6f5a015b75afbd5b6c2f8c34b01629cc38
SHA512 7e56bdee11a586094b76b7c946c2bc5443059bdab8267e2591ce36135211d39fae34b55c721be405a5689b07cc79c93b3f8dfe5ca4ca8555d1b278099f011a43
SSDEEP 1536:6TJsUSvUbU/HYtR/bI6MXLxu8EVeVkxf0y71oWphlJ/2ZbBgO4:lbvUIHYP06M7xu9Veexcyzphipij
TLSH
T14B83020FC89079C8F26367A4ADF16C71EAA3710320C9AF87305F865687F491AE91F695
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_1352839218\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_291710499\json\i18n-mobile-hub\zh-Hant\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_291710499\json\i18n-shared-components\pt-PT\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_1874656119\shopping_fre.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_291710499\json\i18n-shared-components\de\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_291710499\json\i18n-tokenized-card\de\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_291710499\runtime.bundle.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_291710499\wallet-webui-560.da6c8914bf5007e1044c.chunk.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_809507004\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_1874656119\shopping_iframe_driver.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_291710499\json\i18n-ec\en-GB\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_291710499\json\i18n-notification-shared\zh-Hant\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_291710499\json\i18n-shared-components\th\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_291710499\json\wallet\wallet-checkout-eligible-sites-pre-stable.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_1352839218\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_1874656119\shopping.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_291710499\bnpl\bnpl.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_291710499\json\i18n-notification\fr-CA\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_291710499\json\i18n-notification\id\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_291710499\json\i18n-notification\it\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_291710499\json\i18n-shared-components\el\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_291710499\Wallet-BuyNow\wallet-buynow.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_291710499\Wallet-Checkout\wallet-drawer.bundle.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_809507004\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_291710499\json\i18n-ec\hu\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_291710499\json\i18n-notification\sv\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_291710499\vendor.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_291710499\json\i18n-notification-shared\fr-CA\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_291710499\json\i18n-hub\ko\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_291710499\json\i18n-notification\ar\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_291710499\json\i18n-notification-shared\fr\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_291710499\json\i18n-shared-components\id\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_291710499\json\i18n-shared-components\ja\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_291710499\json\wallet\wallet-tokenization-config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_291710499\wallet-webui-792.b1180305c186d50631a2.chunk.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_291710499\webui-setup.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_1615622984\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_291710499\json\i18n-ec\fr\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_291710499\json\i18n-hub\it\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_291710499\json\i18n-hub\ja\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_291710499\json\wallet\wallet-checkout-eligible-sites.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_291710499\json\i18n-hub\en-GB\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_291710499\json\i18n-mobile-hub\ru\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_291710499\json\i18n-notification\fi\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_291710499\Mini-Wallet\mini-wallet.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_1352839218\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_1874656119\shopping.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_291710499\json\i18n-mobile-hub\de\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_291710499\json\i18n-notification-shared\pt-BR\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_291710499\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_291710499\wallet.bundle.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_291710499\json\i18n-ec\nl\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_291710499\json\i18n-notification-shared\el\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_291710499\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_1110092444\Filtering Rules-CA	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_291710499\json\i18n-notification\en-GB\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_291710499\json\i18n-notification-shared\de\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_1110092444\Part-ES	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_291710499\Notification\notification_fast.bundle.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_809507004\_platform_specific\win_x64\widevinecdm.dll	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_1110092444\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_291710499\json\i18n-notification-shared\ar\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_291710499\json\i18n-notification-shared\fi\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_291710499\json\wallet\wallet-notification-config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3400	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{9A120DD6-6411-4346-88B8-913E96858F4A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4740	AcroRd32.exe
4740	AcroRd32.exe
4740	AcroRd32.exe
4740	AcroRd32.exe
4740	AcroRd32.exe
4740	AcroRd32.exe
4740	AcroRd32.exe
4740	AcroRd32.exe
4740	AcroRd32.exe
4740	AcroRd32.exe
4740	AcroRd32.exe
4740	AcroRd32.exe
4740	AcroRd32.exe
4740	AcroRd32.exe
4740	AcroRd32.exe
4740	AcroRd32.exe
3540	msedge.exe
3540	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
6092	msedge.exe
6092	msedge.exe
6092	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4740	AcroRd32.exe
6092	msedge.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4740	AcroRd32.exe
4740	AcroRd32.exe
4740	AcroRd32.exe
4740	AcroRd32.exe
4740	AcroRd32.exe
4740	AcroRd32.exe
4740	AcroRd32.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 672	4740	AcroRd32.exe	93
PID 672 wrote to memory of 4416	672	RdrCEF.exe	94
PID 672 wrote to memory of 5352	672	RdrCEF.exe	95
PID 672 wrote to memory of 5352	672	RdrCEF.exe	95
PID 672 wrote to memory of 1432	672	RdrCEF.exe	96
PID 672 wrote to memory of 4668	672	RdrCEF.exe	97
PID 672 wrote to memory of 3344	672	RdrCEF.exe	98
PID 672 wrote to memory of 1996	672	RdrCEF.exe	100
PID 672 wrote to memory of 1996	672	RdrCEF.exe	100
PID 4740 wrote to memory of 6092	4740	AcroRd32.exe	116
PID 6092 wrote to memory of 6124	6092	msedge.exe	117
PID 6092 wrote to memory of 3400	6092	msedge.exe	118
PID 6092 wrote to memory of 2848	6092	msedge.exe	119
PID 6092 wrote to memory of 2848	6092	msedge.exe	119
PID 6092 wrote to memory of 2848	6092	msedge.exe	119
PID 6092 wrote to memory of 564	6092	msedge.exe	121
PID 6092 wrote to memory of 564	6092	msedge.exe	121
PID 6092 wrote to memory of 1668	6092	msedge.exe	122
PID 6092 wrote to memory of 1668	6092	msedge.exe	122
PID 6092 wrote to memory of 1668	6092	msedge.exe	122
PID 6092 wrote to memory of 2332	6092	msedge.exe	123
PID 6092 wrote to memory of 2332	6092	msedge.exe	123
PID 6092 wrote to memory of 2332	6092	msedge.exe	123
PID 6092 wrote to memory of 3804	6092	msedge.exe	127
PID 6092 wrote to memory of 4360	6092	msedge.exe	128
PID 6092 wrote to memory of 3804	6092	msedge.exe	127
PID 6092 wrote to memory of 4360	6092	msedge.exe	128
PID 6092 wrote to memory of 4488	6092	msedge.exe	130
PID 6092 wrote to memory of 5888	6092	msedge.exe	136
PID 6092 wrote to memory of 4504	6092	msedge.exe	137
PID 6092 wrote to memory of 1000	6092	msedge.exe	138
PID 6092 wrote to memory of 4932	6092	msedge.exe	139
PID 6092 wrote to memory of 4932	6092	msedge.exe	139
PID 6092 wrote to memory of 748	6092	msedge.exe	140
PID 6092 wrote to memory of 748	6092	msedge.exe	140
PID 6092 wrote to memory of 2544	6092	msedge.exe	148
PID 6092 wrote to memory of 2544	6092	msedge.exe	148
PID 6092 wrote to memory of 4796	6092	msedge.exe	149
PID 6092 wrote to memory of 4796	6092	msedge.exe	149
PID 6092 wrote to memory of 3540	6092	msedge.exe	151
PID 6092 wrote to memory of 1904	6092	msedge.exe	152
PID 6092 wrote to memory of 1904	6092	msedge.exe	152
PID 6092 wrote to memory of 4000	6092	msedge.exe	153
PID 6092 wrote to memory of 4000	6092	msedge.exe	153
PID 6092 wrote to memory of 5304	6092	msedge.exe	154
PID 6092 wrote to memory of 5304	6092	msedge.exe	154
PID 6092 wrote to memory of 2928	6092	msedge.exe	155
PID 6092 wrote to memory of 2928	6092	msedge.exe	155
PID 6092 wrote to memory of 4392	6092	msedge.exe	156
PID 6092 wrote to memory of 4392	6092	msedge.exe	156
PID 6092 wrote to memory of 3164	6092	msedge.exe	157
PID 6092 wrote to memory of 3164	6092	msedge.exe	157
PID 6092 wrote to memory of 5908	6092	msedge.exe	158
PID 6092 wrote to memory of 5908	6092	msedge.exe	158
PID 6092 wrote to memory of 3972	6092	msedge.exe	163
PID 6092 wrote to memory of 3972	6092	msedge.exe	163

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\AR Difusión S.L..pdf"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:672
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=89D264A8BD79B29FCACB3517859F6F0E --mojo-platform-channel-handle=1676 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4416
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=F6923494A58206A9251B415FDFEB5DA2 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=F6923494A58206A9251B415FDFEB5DA2 --renderer-client-id=2 --mojo-platform-channel-handle=1724 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5352
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=65A897078D3AD411F313678EC17F414B --mojo-platform-channel-handle=2272 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1432
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C61CA3CFCB49B8673847EB2F230B8A9A --mojo-platform-channel-handle=1924 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4668
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=09F0AB4548066F134670A39C6E8F8E3A --mojo-platform-channel-handle=2316 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3344
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=5313AED2BF7752853E197295F0EB12B0 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=5313AED2BF7752853E197295F0EB12B0 --renderer-client-id=8 --mojo-platform-channel-handle=2504 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://login.0nline-softline1.nl/?spk4o7ovg3HMxQ=eGJzbg==
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:6092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x35c,0x7ffa2b54c188,0x7ffa2b54c194,0x7ffa2b54c1a0
    3⤵
    PID:6124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,1630638666390995016,11299537485032322053,524288 --field-trial-handle=2340,i,17176099432029739546,18346450429233212518,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1760,i,11294016037263637010,1254222371243643929,262144 --field-trial-handle=2340,i,17176099432029739546,18346450429233212518,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:2
    3⤵
    PID:2848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2432,i,10674239130622163412,2615283526090108732,524288 --field-trial-handle=2340,i,17176099432029739546,18346450429233212518,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:8
    3⤵
    PID:564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,18071248739039345950,2595389713879610255,2097152 --field-trial-handle=2340,i,17176099432029739546,18346450429233212518,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
    3⤵
    PID:1668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,1128287528906832482,13956121351085592224,2097152 --field-trial-handle=2340,i,17176099432029739546,18346450429233212518,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
    3⤵
    PID:2332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4836,i,12495306727826511539,10349855780878245620,524288 --field-trial-handle=2340,i,17176099432029739546,18346450429233212518,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:8
    3⤵
    PID:3804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4916,i,15015989861617631200,15450092141965457866,524288 --field-trial-handle=2340,i,17176099432029739546,18346450429233212518,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:8
    3⤵
    PID:4360
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,5947244181339070033,13476067747803525628,524288 --field-trial-handle=2340,i,17176099432029739546,18346450429233212518,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:8
    3⤵
    PID:4540
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,5947244181339070033,13476067747803525628,524288 --field-trial-handle=2340,i,17176099432029739546,18346450429233212518,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:8
    3⤵
    PID:4488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,567372254650381174,14879480906630991734,524288 --field-trial-handle=2340,i,17176099432029739546,18346450429233212518,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:8
    3⤵
    PID:5888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,942469434735031500,13369951336115919302,524288 --field-trial-handle=2340,i,17176099432029739546,18346450429233212518,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:8
    3⤵
    PID:4504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,435296391101326429,17399504758628555894,524288 --field-trial-handle=2340,i,17176099432029739546,18346450429233212518,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:8
    3⤵
    PID:1000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2980,i,1081980011286063798,6199791481190493815,524288 --field-trial-handle=2340,i,17176099432029739546,18346450429233212518,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:8
    3⤵
    PID:4932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,8190894302187760958,5277222331211329413,524288 --field-trial-handle=2340,i,17176099432029739546,18346450429233212518,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:8
    3⤵
    PID:748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,9540975470502905770,13172544095448220666,524288 --field-trial-handle=2340,i,17176099432029739546,18346450429233212518,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:8
    3⤵
    PID:2544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=852,i,6025410447905377185,3240490767797604228,524288 --field-trial-handle=2340,i,17176099432029739546,18346450429233212518,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:8
    3⤵
    PID:4796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5852,i,14314341279702174431,2350413267559880143,262144 --field-trial-handle=2340,i,17176099432029739546,18346450429233212518,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,11850460350302627103,913416826141766571,524288 --field-trial-handle=2340,i,17176099432029739546,18346450429233212518,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:8
    3⤵
    PID:1904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,9316548459623095507,6053583827958522910,524288 --field-trial-handle=2340,i,17176099432029739546,18346450429233212518,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:8
    3⤵
    PID:4000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3804,i,12207193790538471663,11609455532716773793,524288 --field-trial-handle=2340,i,17176099432029739546,18346450429233212518,262144 --variations-seed-version --mojo-platform-channel-handle=700 /prefetch:8
    3⤵
    PID:5304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,17172895907475383193,2456142964765907056,524288 --field-trial-handle=2340,i,17176099432029739546,18346450429233212518,262144 --variations-seed-version --mojo-platform-channel-handle=3012 /prefetch:8
    3⤵
    PID:2928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,6935061873286587179,1840931729452159316,524288 --field-trial-handle=2340,i,17176099432029739546,18346450429233212518,262144 --variations-seed-version --mojo-platform-channel-handle=700 /prefetch:8
    3⤵
    PID:4392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,9029104273524852371,71177764627716796,524288 --field-trial-handle=2340,i,17176099432029739546,18346450429233212518,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:8
    3⤵
    PID:3164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,12568678008058842072,5361771743109352058,524288 --field-trial-handle=2340,i,17176099432029739546,18346450429233212518,262144 --variations-seed-version --mojo-platform-channel-handle=1308 /prefetch:8
    3⤵
    PID:5908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,2435809451352665076,152502541778181715,524288 --field-trial-handle=2340,i,17176099432029739546,18346450429233212518,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:8
    3⤵
    PID:3972

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6092_1043334482\manifest.json
Size 118B
SHA256 83e0c7497c3ec506ea54066f33f789654ca1bb7cda4766dd3f200ae3d5ff34e8
MD5 767dc06f40a419c760e4eff49c01034a
SHA1 c16241a0dfa6608bba957ccb6b145dc16c03297c
SHA512 42c9fc1b4b744162a88f0ab72422d74a5d96eaef019f97e78a8be9e42d071473560553af9d55f920bf360c64ddf4c465ab3378c48f8081781387913a076410b0
TLSH
T1FFB092B00C1AA03B22809720ECB0668787F80219E8425B1A088036481F882B981362B2
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6092_1110092444\manifest.json
Size 116B
SHA256 181a1631374b5ac1fff89559f7e23498ad9ee4796885d7b956d5e7d5f9c3f8c7
MD5 daf93729356a67ea1f849554827fdab1
SHA1 17dad0cbc82d5e04fb068896a5832f983e124c01
SHA512 473d9d608f2f3324d5db6eddeb4554a7271df4a6b62377820d935c001a8a2376479aa4d3e3b80ffbfdd3ba80f56fe72f1bc9dd020bcb396182b753353b883a30
TLSH
T1FBB09262A8084633249523F4A2639363CBA86D4A91346606091B9480659E73B22A5219
MD5 SHA1 SHA512 TLSH

Submit Download

deny_domains.list

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6092_1352839218\deny_domains.list
Size 12B
SHA256 f51a7acfffec56d6751561966d947d3fd199b74528c07dabdcf5fcb33d5b2e85
MD5 085a334bdb7c8e27b7d925a596bfc19a
SHA1 1e4ad53dc335af5c6a8da2e4b4a175f37fafe2f2
SHA512 c883cb43c97a136825c6fd143f539210c234c66f9b76dfd8431f6ff014094e20b9410d7462aadee2344df8ca158def6b9a807e7cadbdfa947f6f8592e7283e34
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6092_1352839218\manifest.json
Size 177B
SHA256 0e9ec9e79542b4a26ff5da5ff91ed23c0fc9d4ee655cc135b64726daafb364a0
MD5 b06cf477c7639438f14301777daaaeb4
SHA1 77f7a86139f01bf8838df12e4c839143c0958932
SHA512 526576792f56bae509e5de7936815bacbdb262884c7b06110b5ad649b8ea8260622eba0244043ee6a972395297cbcbdc830cc105bd2526b619885c6c0ce42ce5
TLSH
T18CC012DFDC509DB119EB4332156D43C4D733CF0B1546450935FB66082E25985C193500
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6092_1615622984\manifest.json
Size 53B
SHA256 7612538ef6ea25a2078adf4ebda2b0565546d80189b6af46bb0e1c9744d720d5
MD5 46b34a0f2dbd5b58337d4cf05bdb4797
SHA1 b190fc81ede34f9fe8f4f5dee1b915331b76cc19
SHA512 49d0691d8eea580f863190f3073552b74bd550ec8b0a1b748fa0c5a18f05a515390735264f62f1aee0590017a1e4e85e470c32bfd49dfd371a47d1493ecab664
TLSH
T1B79002600414921716C10E906571B895A391661955850D1D04551558029586CE150298
MD5 SHA1 SHA512 TLSH

Submit Download

edge_checkout_page_validator.js

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6092_1874656119\edge_checkout_page_validator.js
Size 1021KB
SHA256 4bd84a271e6aeee39cc614bb6fa9e60ad465f61b6a305f9f69b995f9af910219
MD5 84017bbd252b4e3da14c6c6f7966da0c
SHA1 619a6e18fddfe2003aa3799e48a30d4e4d1be2ba
SHA512 719563802aa0f7154333295cad12e0184c2da0108bcd5e009e0828326094e9d49fe16b1fd5de874ce583896c32a85659d554d1816670ba17bc07b4f7a97f657d
SSDEEP 24576:j142AzAtsJvGxkVKA8nG8O4cELKXnhw5BD6Nc6U2y8enpBtSLVzhEiJsfaWZPS6Z:j142AzA+JvGxkVKA8nG8O4cELKXnhw57
TLSH
T174252B80E1E2253466D74CB960B7D2C4B5DC04587399F1E8FA6C68CADB0F94723F663A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6092_1874656119\manifest.json
Size 146B
SHA256 7e765ccd9f7f89bc111ef17d12194e83940dace4320e67bd582211969f117da1
MD5 ec88e92109abcf84de7911dd22725ce2
SHA1 b8a7b83f5ec59289282350824653b73712e89896
SHA512 b8f7e86d56f579a0b2b2c7b852e9322fa0424954f308587734ed2e5e8e3f7c8c38b7ecc42a92871885a9fb53695572ac687d5b92d67a9f6a87a3d29980c3ab13
TLSH
T174C02B33CC31AC300D3007E408F08601EB34134FF500B0163730008D0B3C470D0206D0
MD5 SHA1 SHA512 TLSH

Submit Download

notification_fast.bundle.js.LICENSE.txt

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6092_291710499\Notification\notification_fast.bundle.js.LICENSE.txt
Size 551B
SHA256 38ed54eb53300fdb6e997c39c9fc83a224a1fd9fa06a0b6d200aa12ea278c179
MD5 7bf61e84e614585030a26b0b148f4d79
SHA1 c4ffbc5c6aa599e578d3f5524a59a99228eea400
SHA512 ca5f2d3a4f200371927c265b9fb91b8bcd0fbad711559f796f77b695b9038638f763a040024ed185e67be3a7b58fab22a6f8114e73fdbd1cccdda6ef94ff88f3
TLSH
T108F08B5A31E12673416285A1270B52DE7F0C10BDB0AF39779444C3386C348EE82D0EE1
MD5 SHA1 SHA512 TLSH

Submit Download

tokenized-card.bundle.js.LICENSE.txt

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6092_291710499\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt
Size 1KB
SHA256 363f376ab7893c808866a830fafbcd96ae6be93ec7a85fabf52246273cf56831
MD5 8595bdd96ab7d24cc60eb749ce1b8b82
SHA1 3b612cc3d05e372c5ac91124f3756bbf099b378d
SHA512 555c0c384b6fcfc2311b47c0b07f8e34243de528cf1891e74546b6f4cda338d75c2e2392827372dc39e668ed4c2fd1a02112d8136d2364f9cab9ee4fa1bd87f5
TLSH
T1A2313A5B32F53673416245A1670B52DEBF0C24AEB56F38B79495C3387C388ED82D1DA1
MD5 SHA1 SHA512 TLSH

Submit Download

strings.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6092_291710499\json\i18n-tokenized-card\fr-CA\strings.json
Size 2KB
SHA256 c67b555372582b07df86a6ce3329a854e349ba9525d7be0672517bab0ac14db5
MD5 cd247582beb274ca64f720aa588ffbc0
SHA1 4aaeef0905e67b490d4a9508ed5d4a406263ed9c
SHA512 bf8fa4bd7c84038fae9eddb483ae4a31d847d5d47b408b3ea84d46d564f15dfc2bae6256eac4a852dd1c4ad8e58bc542e3df30396be05f30ed07e489ebe52895
TLSH
T17251EE3D88F4489B60C7921B6B1142D7C9704E36D704F3848A63828A035BDEFB0BF69D
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6092_291710499\manifest.json
Size 121B
SHA256 cd25cc1afcc03514d978f0a90692454e810c3cc81763074e0ea5ac504255335a
MD5 8083caaf7f5bc5f01ede464e68db1c7e
SHA1 ed6cf18f79c4ee2968adfffe7bf1bce163ef3873
SHA512 60924bd5617ac5f994805f9a871999764ba93c6adda79c501a0b692dce51b9db6f6531a5e25129bc424ae7c4de868ba6e5a976d6bcfbac2bb8bd192c5513c7ee
TLSH
T10CB0922289429D300469079809B486A6E230674BE406F0397B7041CC8B785B8A4A2A94
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6092_809507004\manifest.json
Size 1002B
SHA256 dca3cd7a673d0776a085c0b8958a85bdd8392923db21a0b55f4d37210f752322
MD5 9be87722ce3608a2d38a79079feaa394
SHA1 34ed541044567272d5402b30fa99eff29d70e9b9
SHA512 d4d22a3c277a9cc3325f4f6f15f18c56efc6945ce8abccae32d66158b9f35039b347e93d0f1002b66336fbef2d750f78184e6a4b72644cb71a2ef944af52388d
TLSH
T10B119B00CC388DD322D4BAA21CC6580A93621DAF4CC23E84339E161D8F1C8AB927366C
MD5 SHA1 SHA512 TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
TLSH
T178F21D566E241E3CCA9EC336340836C34D78023DACF3B762A58A719747AD181E37D6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
TLSH
T1C94379DF2A348110CA0768BABD71771BB655D0BFC1C2F0A87AD68A1780B463CE775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 dd922b8bbb46f224bfd03b8ee20f2f273e1082a79f8717fcee81d71f48334802
MD5 e24615d5f216feaad43dad6524cac715
SHA1 7c8b7a23a121d9060a595e1568ab99a3e1bc8a41
SHA512 03b779fad92ab75bf61831837b73130c7d234c7d6d68a8feb16fd4f81a2a071818edf9bef2f5fccc5d80ce959af6f44decc46adbbb80fc7ab21c90647b1de52f
SSDEEP 384:yezdThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:++eUZsLQCZsL3hUS4
TLSH
T1A653CBDB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2f67a665126f0d437497b394b50cc87ce72773b6abd85385bb78adf0ad326302
MD5 a98f4348736e1c7c5e70799864c15774
SHA1 fa2e3725e970aab935f77d155b649177f50be7d6
SHA512 c1dd68c743d45af6f713c7d8fade4a675abe4d224e86b956c5aaf959ccda0a92b9824b0e784a0ee9992843bfc2a7a73f85267479d6e5ffa0aa5827760492419d
TLSH
T19ED02B20B6A87654E006343C0114428C31CE5570140BB400809413A40FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 1a1f92533892296a481fbce740ecd997ac998ff5c5d9b97858eaef684efbbf00
MD5 ce4f8823acf4b52c159fb46698fadbd6
SHA1 0989221263d7843bb7aba0b0159ccb4ea13fce93
SHA512 f2cdb6e3eac70de81d6f3be6b445062d8ff9b9dbd686494380597d7cb721b1aeb2b839c75265ed6d4eb0fb960e4d6411c2072dec6a65f3c91a8b6d4695d007f6
TLSH
T12EE0DFAC19C9C2AEA200649752AD6B0CC2E0370B92CC6A8A1B0188847206868ABC2A91
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 32ad30f8776462813d46e7727f07318b6ce2339e4aedd9c1c8b209f72647940d
MD5 ac28898fcf3d8f6d75f67836fbe654d4
SHA1 f65b8dd9bfcffb0c8b9ce0e3510ce2b921c48a5d
SHA512 d29fab65b97634606c0c7565dacb391050f857f9b397b1da2dfe35cb560c7146e6efda249c743299f024b4023eb936c7cfa14b985928cf2dee46ff571d841d2a
TLSH
T113E07D8826C8C36FA200784B42AC9B0C92E0375BD3CCAA8A5B01D485B205058F3E3791
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 0393da621e43e3f57201b2e8fb8ecbf6d3672e05a01e7dc359c9c0ee9a12487f
MD5 fa86cddf51e9fb7ec086b49f84aaf759
SHA1 63cdd3c6d051a2b25b3ef03d5cf520e59dcd6c01
SHA512 d6c866c05fe3e4ee5ccbafd655eadcbe9a0bd0631d228b415c575cceda3dbccb6b453304ee4dc20ab346fb2c2098ea483afb749e8e3bcda7d0c0a606a4b1f92f
TLSH
T108F028B5D921FC3B08FD0B7960A40B4AF751236B2A41984F3B3D810C8FB593B8586C2C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a65b05c30fee29308542e48d23916d7d7a5f52d3e4c35042154ef61df23ef361
MD5 128b6957459290884b2ab88f05876e00
SHA1 5eb7f9f69a5ad22763619c414491b11886a9935b
SHA512 3c305486a42ef358fac5343c47e3c166923deb139e0548ca669bf8216dbd4e9eb00ad68faca58109ae8721fc0bd17ff74c8844997a0ca8b9f8d402bf4b73948d
TLSH
T17161D961D7408974FFCCA570A2E499B7353C4942DFE3BE8394E6FCBAF89A3156100204
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a3941.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a3941.TMP
Size 3KB
SHA256 2473cfaa07c6b52c81faaae78c6544cd9ae1ba5070c17e3763ccc4dbcd1918a7
MD5 db2edf95db30da257027d624287310b0
SHA1 c6a8ffce216414c2f5be75ae318c98aef5ceec7e
SHA512 c479b8035b01e6b7263d9bc6f27e852d881ad5f0fa7841eb08f76fdcd06e62dfc8954f28f41b4491e2bb99a55a92ca9e2d62cc57b6148e7315ba00af6a69ae90
TLSH
T17751C861D7504874FFDCA570A2E4A8BB353C4942DFE3BE8384E6FCBAE89A3146200204
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 648650f9f201bf839722a4ae10478a9e6c8360607a01c02f8773d9fc689f7e1c
MD5 2fceeba66b689a9c82e9f16e3402b4e7
SHA1 eeba66310f9f570b45f6bd68dc44796c4e98c7cb
SHA512 bbc1c69707e40586035572904a031007bb4be26b8875749ae0ec6b8ed93f7a2ca3a29451f5710031757b69c27f12abe5230b8b735d0ec9c688a91f71b3fd1c70
SSDEEP 48:YALlgyDPN5O3BR3U37R31R3sR3dMsfRs+fo7gmzstw1zEsCndqBCIsBTJsWBdosJ:D1jOXE1rQBFaX1zedqB+1kDNT6wJGP
TLSH
T1ADB1C0E3C2E4869EC91126F0AB14AE1AFF5E1B14436C3D5EC5D8DF4BA3E2470D68154E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 97b706d3e081544a1823acc7f763feb7f34bf1a7228a685f3b86ee5a44d2f2e5
MD5 23e37ee6298fd3d716b1faf2eb8eb282
SHA1 16cfbf50c99b9dfcb3a0932923036b19b75034bd
SHA512 adf9579e13e83dcd46b97240dd29d2299e5c215a972489e37edbae8c7d692d6e80f97cd0360a90ee8b2abac031f1e2d3b6abefabe51e761949f1d9b4465e7c3b
SSDEEP 48:YALlgyDPN5O33R3p33R3sR3LR3uRC8xsfRs+fo7gmzstw1zBqBC9TSuJstQg6wB+:D1jOx5xQF+uFaX1zBqBqW5T6wBUGj4/3
TLSH
T11A91BEB3C2F4869EC91166F0AB04EE1BFE5D1A14436C3D5AC5D4EF4BE3E2470E28164A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 8af278de0041361d6eba4015c845f1203d2d547ac9412d1be91b7144be6aad4d
MD5 ea7e49fa57a09f5afc3f0fb89db52605
SHA1 51726e4dcfe61961a7bd4fcf9ea23b4830c4178f
SHA512 ce62a71a1f9187fa7285c7b55597a84cae1ca99a41e4c2395e5e46a84e0fe2ac149f60599db5c1882f14ef10405a67bb8463c403088ea922fa8547f396f6b3ca
SSDEEP 48:YALlgyDPN5O3BR3U37R31R3sR3dMsfRs+fo7gmzstw1zEst8xsFCKsCndqBCIsBO:D1jOXE1rQBFaX1zeG9dqB+1kDNTwQ
TLSH
T1E3A1BEA3C2E4869EC91126F0AB14AE1AFF5E1B18436C3D5EC5D8DF4BA3E2470D68154E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6d585e0631f55ba48c62ca433c597a711e657af7c7a9df56edb919345a0924c7
MD5 45d7a24d279c80cfb79bcacf48e70bf1
SHA1 655e488d258c04367960d093d0f2fa64fe9782b0
SHA512 5b3c9c6a634f9f33f9182b083c189d508eb9758592d80b32e1a8daa14716bde6574c9bfa56703bb9093a05dbe57a536f96199e81088bc981ad78d0490ed48a91
SSDEEP 192:sxZ9bRGjVr/f14sbCaQZLjP8eMzodp5uHW6+WN3aB/YoKJS/VIg5AtJVJ:sxZhUd/fCsbLOPEc8HbE/YSBKtJ/
TLSH
T19942D715AD28A97F8CC7E219BB55BF53D3F9503390811E48AAFC8A2C14E7ADD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 27KB
SHA256 07e71b703a7456d2e54d9a2707397b0b26366257979b18753c3034b4677cff22
MD5 ee0040ecc6ab12b8d1207d3718dcd9e6
SHA1 c0e01d0ab0f04e0cb73911d9516e1e0c9cbcd9fb
SHA512 62184d755304d9304a80f080311c6a9470af834bd72f7ecae2bc5042babbddd836762b7517fc260c1697543faed0b62bd079829c9afb828a08c07b35f559053c
SSDEEP 384:sxZhUd/fCsbO66s8qMpRiYnazAW8pZS15posJWeT+GOPEc8HbAXqSEAtN:sJUd/ftO4Mnc7WeT+GtVHbGqSBN
TLSH
T167C21A04A924C83B9EC39D18693D7E33DAEC506211C5DEDE5AECCA1C019E1FDAB07457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 671abb5362021321dabe8ecc4c55fda12524266e036162934d037ef9e6957d04
MD5 3659b2092ff284033ae47ef368d06306
SHA1 fa4125c6cb5b464abc33e28880d92f1869226760
SHA512 dbe114791ea1b97821e0f3a1a88b75119a9b3ff8aed47608a743e6a6fed0950edaf45a64754266b87158a642ec47c28b58ab31dddb6c0bdbe69879fcc5c2df02
SSDEEP 192:sxZ9bRGjVr/f14sb5QZLjP8eMzodp5uHW6+WN3ihXYosJS/VIg5sFt7J:sxZhUd/fCsb5OPEc8HbAXqSBAtN
TLSH
T18642E855AD28A97B4CC7E219FB55BF52D3F9503394811F88AAFC8A2C14E7ADD120341F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 16b388a5118a4b625085d9c6d026594614acaf9f46356067856b9b1fc4da0e98
MD5 4023d2e2bc20c5d3cbf676093981c26a
SHA1 5970985004b25b0217ea673df358a4c1e91ce1aa
SHA512 d460f6bc877df678ca6e0be17037f825c6518a659bdad6b28e1949f34733cb650d4220dba3acdf85a14c8bf97c134deecd7b0a1438f7bcfeba4f43c811ef10fd
SSDEEP 192:sxZ9bRGjVr/f14sFCaQZLjX8eMzodp5uHW6+WN3aB/YoKJS/VIgjtJVJ:sxZhUd/fCsFLOPMc8HbE/YSBjtJ/
TLSH
T1DC42E815AD28A97F8CC7E219FB15BF52D3F9503394811E48AAFC8A2C14E7ADD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 73dbcfd317a442f710e356e9784c3a3293aa7e025f2244dd0feef1b9c0ef7f14
MD5 12c5259a5cc9d36c3614ce83efdd9684
SHA1 f53d2ffc8f5aa9e15aaf03a44198c9ac31d1dbdb
SHA512 07aa7f90b2d07f993e6213278420c1a16c151cefdbe725816890e5af774ea080c03e5b5af309d4a6a041af9bb867a2d339a638f68d7438c0ccf2759469b5118c
SSDEEP 768:Px6r8sW7pLuLbG+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVa1qpLlvVajYrop:Px6r8s2EbG+WviyUKu1jab1qpLd4jjoY
TLSH
T1D7E2F97B780CCF7E4FC04A9DDD1A7F8A6DA802CB9698C94087FA945C02C67EA51174DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 c8f07390e015e08b9b3aa5bc5374ecd830982d06fd769dfb03d869b4e6113876
MD5 df05de9149b5b186487dbb7c7c62f14d
SHA1 b7b44ae4077f7964058df41313c07907ab56ba7a
SHA512 30d6d1f70cbf75dfb2c53bb14b2d55da62028c008e92b407a675012a08b58c533c8088aa6d1353b40601b8a1985efe4df3ee7e031945849c2587c7a0e366f25f
TLSH
T1B1E068B71BE60800A8AFA3DA283115A401497868C984AC4F142BA3C350E17693413C23
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 6c28b8e91e086f382f90fe9c0d4d0211594e3dd8cc5cba9160e0f4a8d5162d5b
MD5 9726e34d5cb74b1140aa5d09aaf98863
SHA1 66022252b10f54c8b3b6babfdb0c801636426e11
SHA512 b740252cef63544af931de91b95c78cfd709dab0bc58b20528f83ac3879d9971f8595c53faff3f3a9949015b5428458ea123cb6abc0aa41f4699c9bb681caf61
SSDEEP 96:KM8wKFqmq2sK3qsrWKIcKKsAKVK66QKTywO3aKoErbWKY0KGnuKc82DOhVLZZdgc:ST/2dXOJhJlpfnpp3tNXVrN3+tft
TLSH
T1D2B2121571BB421039FE391891B59B2E068272733119E66B7FBD04B68E2BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.25\data.txt
Size 152KB
SHA256 4e932235a6fefae59866c98f69253bf2d3d0e7e2a2a9ae546685bc4646f9a297
MD5 b5394eb229ba53caf4fc321b5087e299
SHA1 b84ae45b51a9d200639a10ea487b1ba9b94ed3eb
SHA512 6e6f890c6fc57d470e2bedaf5b022d13e54762c8d424a4a43493b7eb68f2d22be2a1641f5ffa25a1756fef938841ec50c908e97161da28158a2c7e3b258b39d0
SSDEEP 3072:wPAgDcCHaLHl65aynyosxb3+BLvf55rOiWF4Vkia/UFwK:cX1aI5aZoKzMDXrOiW1igUB
TLSH
T1AAE3F240C9D0AFDDCEA8161C90BE0F1963E1CA8EC13A958ADB23FD4B6FD3A045A175D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wallet-checkout-eligible-sites.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-checkout-eligible-sites.json
Size 23KB
SHA256 2abefae3d72e7c4f5cdc94eb0ee552612d843a26faf4a7bd061c73839e19d7eb
MD5 ed22bc3ded6df0109b9e594867473559
SHA1 ee39eb80dc23f7fd764199cbe4a153c4edc2e768
SHA512 fb337c0a0107dc37a3067bcd6f60ffb8f63ee892a0ff729dcdf67c7a21fec95a742a274853e8947489108d7543c13b9479e02574f490bc217e8a182f08543aa3
SSDEEP 384:rQR5dkrKzmQWgFlhpyZv8CTi8I6kxAvh0mD:reKrMP8d5JIVAvhV
TLSH
T18CB21064C9210DE11FE4412B6878224B1A3C951B8F90FAFE3B6D928C1F5E06F61B95FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wallet-notification-config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-notification-config.json
Size 804B
SHA256 bb26ce6fe9416918e9f92fcc4a6fe8a641eceea54985356637991cf6d768f9fd
MD5 4cdefd9eb040c2755db20aa8ea5ee8f7
SHA1 f649fcd1c12c26fb90906c4c2ec0a9127af275f4
SHA512 7e23b91eab88c472eec664f7254c5513fc5de78e2e0151b0bcc86c3cd0bf2cb5d8bb0345d27afdd9f8fcb10be96feaa753f09e301fa92b8d76f4300600577209
TLSH
T1AB0189EEC8800EB216C24A3A163985C31A3756576C953D147FC9741C2F5D62F22FB98D
MD5 SHA1 SHA512 TLSH

Submit Download

wallet-stable.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-stable.json
Size 81KB
SHA256 c1611bb1872456d5ba656cacea801b833ea43126a6ad7e43e143d52cba9d9597
MD5 46ca0b1726448d9c7ed48735c246336f
SHA1 8e26f1f1c6f909f2f3d34c17e042e579f3b2b449
SHA512 c9ec0465c2c0eb0bc0316163f9a2dab9332c372dfc4ebedb0ef4139fe1195efdd8aa34367155c29e659d97d5a27e2395ce2f6012c115ef5791bad270de26bb28
SSDEEP 768:r7PEXSl9cv2tlNnqSBBoCJkQgXzwb7XARjMLVF2CYgYHFkJ/Eqajvapznp+9l:08W27jLgX2ZLSgYHFkJ/EqajvWnAf
TLSH
T1F283DB29C9120DB11FA4001A28BA290B297C960B4F55FAFD7B6C938D1F0E45F61F59FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wallet-tokenization-config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-tokenization-config.json
Size 34KB
SHA256 0088d5ebd8360ad66bd7bcc80b9754939775d4118cb7605fc1f514c707f0e20d
MD5 ae3bd0f89f8a8cdeb1ea6eea1636cbdd
SHA1 1801bc211e260ba8f8099727ea820ecf636c684a
SHA512 69aff97091813d9d400bb332426c36e6b133a4b571b521e8fb6ad1a2b8124a3c5da8f3a9c52b8840152cf7adbd2ac653102aa2210632aa64b129cf7704d5b4fa
SSDEEP 192:0NOKnK+QXzpTYaDEqIyVZ5mxzrIAfrXKoNKExGI+MmsMR6Q9GMKPrZnfB4FXZ8N:SOKK+QXzpTYaDEq/e5EAfrRoRI+B9wC0
TLSH
T1A3F2FCB1D9009C932F58850A20BA9505376C52237F86F9FA736D424E9F9F58F2530EEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 e5ea54dd19f02d202b24141fb0629d8e256c320c09ac5e43816981597ff41d20
MD5 cfdfb30da1da79c38b94f7fddf121f29
SHA1 0922cc722c6b3cbe8714b2d4edd863a8d4bdd17f
SHA512 c12141b23a91c52133da132eaf561a8cdc665ff52595fea9128fc979e1b96fd1d9a49a4a3c85dc4593957a8578905fbc7da297586a378779cd0ce7f2bbbfd8d7
SSDEEP 384:njiFiZcIoE3sN68TUNTUlI4FaKMma5w2fiBCC2TmD9u7FmhutgOIwZOydngL/7Ie:OFQt3DwgLz+BC5TmD9cFmhuXsXD
TLSH
T131E28FF598D799B7E8AE4B87A37D6E029AFCC123B4885584B7D40C1CCC925BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 795f295e05603537b37ba1e71b168a5a07f75cd341869261d13b2368211d03a2
MD5 2bc16a9e2dbcbaa0d110ce366ce94239
SHA1 2c8d04baa49328777fc6678d1ab9306a17c834fe
SHA512 5a1a8f71bc2c7deed828e527d8bd72316418bfba160168317ac41e78a88cbc3a2a45669c1342029cde0b398d73e61a5f1522a49ef5cea0edd0b9f547a195e959
SSDEEP 384:nviFiZcIG3sN68TUNTUlI4FaKMmk5w2fiBCC2TmD9uiihutgOIwZOydngL/7IzgD:6FQG3DwgLZ+BC5TmD9dihuXsXD
TLSH
T1C6C24B36DCA9D9BBEDF74F89A74A7603DFE0016789889AC4D9D90D1C00935ED030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 4f6a9b0cc47aa311609ad222eec18039fdc0eb44c9edd4cc4c1d00e6945be57c
MD5 3259078edf0bbc7273e15d432ab2d498
SHA1 c3580efc9d0eb44219de79f658b6abebd45fae61
SHA512 dde3fa0fad1cff5959d71700858cc763e55bf4255ff11519719ef02a7133a917a9879461779e8b7cb4691fe1e6b8bc24142781023777ea285e30ffe159664be9
SSDEEP 384:naiFiZcI63sN28TUNTUlIm2aKMir4w2fiBCC2TmDGFi7O6R2FeoivgL/7Iz4ou:RFQ63vwgconBC5TmDGFi7TRXIx
TLSH
T1A6C24A36EC98D9ABEDF74FDAA74A7A03DEE00163858C89C4D9D81D1D00935ED130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 d4d4c5c6fa5c7abd9ecb3d4e5a4d392d2ecf4f7a5542ff5f7c2f77f74b6d750d
MD5 d43d0f64838b643bcfa7d389731feb4d
SHA1 abe09e6a4006fa74dd5aa0db9c1468831dad2577
SHA512 1cfa44adde4d6ee8f90563da5b619514147f68595a01f06319a92908aca5c9265ac0375b95bb465db9b0a78ac3d4987012873c5283470ee72b9d7b55ca99f095
SSDEEP 384:n0iFiZcIG3sN68TUNTUlI4FaKMdk5w2fiBCC2TmD9uiihutgOIwZOydngL/7IzgD:PFQG3DwgLs+BC5TmD9dihuXsXD
TLSH
T102C24B36DCA9D9BBEDF74F89A74A7603DFE0016789889AC4D9D90D1C00935ED030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Filtering Rules

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.84\Filtering Rules
Size 2.1MB
SHA256 5e301c48e6d7290990971e9f0bcb2263c8adba06ed0a2c6db5086949825d999b
MD5 43f62d9f35fa6597cec4e2ad5643e282
SHA1 8dba6404724ffd6a2e89901e8dc6e5e55fed3374
SHA512 91891d23464f89e6769d9ec7a28867e28f77925e6e3b3b75fb628d8672157ba239676c07699c931ac307a21ccc4dae95dd707d410f988ff82be4015103d4d6a3
SSDEEP 49152:ua2qP9SKIrivd04TxN/7Uw+zJEhs6dl61n4Kmq9SL6bbBT0HjTsQc8cxjw:u8d
TLSH
T1BAA55D237518BDF45BB31F3EA44B6D48823962A483E3EDC5EA2BD10ED5E014F79601B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.84\LICENSE
Size 24KB
SHA256 ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
MD5 aad9405766b20014ab3beb08b99536de
SHA1 486a379bdfeecdc99ed3f4617f35ae65babe9d47
SHA512 bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852
SSDEEP 384:mva5sf5dXrCN7tnBxpxkepTqzazijFgZk231Py9zD6WApYbm9:mvagXreRnTqzazWgj0v6XqK
TLSH
T140B2526EB64903731AF30116AA4B64DBF31ED03F362A4564346CC1481FB6E7443FA6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.9.27.1\typosquatting_list.pb
Size 1.4MB
SHA256 beee2fdb920ce6695b8bbde3592e2cce032c95d11b503e262f6c52fb3ae2b9a1
MD5 4ceab02afc91d6845d3b6870130211fd
SHA1 85f1e79a3c0f619a63b80a9ebc3a578b5fac66ed
SHA512 bf61275b42c5ba26e1db50b1ff161cbb04ca4ebfc218497eb0fe788810672ef6fca7977c26a003784e2a0d844dcaa312a513fb4b2c1154b425654403052abd3d
SSDEEP 12288:3NH1o/AtTKm9uuIE8WHZhnVniHSYKhDJcyz:MgKm9H8W5hnmS7
TLSH
T10D65B5B9DFC00184DBB8112D20BE71D8181412A540E9DFEAFE7C859F2BC6AC977E45E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 ccf13e642988b2f3afebd30367cff852de4de3f3f7ef8b793d064256c37e7792
MD5 6436ebc6b3783f172f76a634c2c49f86
SHA1 46afd0b139b1924eeb652b7df687df406878b8fa
SHA512 d1ee8860da08bf43d36bfcdb8f009e1e3b9d2bae72bbc14e4d2d67fcc6f1b5f73253999aed57a288a1bc5621683c8cadb3d5cf687965720283b0de1f2ec6c133
TLSH
T15F5140E05C385AC1D1FD0E7EB09B38EC90ECD725B8A4347E2858E9984A7E61D308483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 3db8d8e4b86fc10d780e22fe61963f2518934da35a7594a1ddd6d21c901d2d6a
MD5 10db5984a4e1cc853581b1365c9b267a
SHA1 e4942a71ab9c13c26f7f4e820395ae219d7c1625
SHA512 bf41817d795f4d30e8f8758cfea0bd0cf678ef3feff1a2442fce8128c4ba8e960e9b0892678f452acc45c8100716ab5b8a4c0d1d58e270270ca3896165bff2d4
TLSH
T1BE412EE04C3C5AD1D4BD0E7EB49B35EC94EC9721B8A4347D7858E9989A3AA1D3040C3F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 6587d8225d9b854a96a5fe151965771b8ea3a55592cacf1672b8b7acc484013e
MD5 87a01eeb0f35c5105b796ac3733d93e8
SHA1 b6fd6bf90953cacf52719a1df1999997dd69f5af
SHA512 93c9d1b172fb8ce4874a8ba4476a13c99c0e32790190eebe9644dabefeb77bc34526d7e00269b1870d7a469ae8166ad41ab4d9820d82017212b65119ce8de4c1
TLSH
T1EA5130E05C3C5AC1D5FD0E7EB09B38EC91E8D621B8A474392858E9984A7A61D308483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 5bd8562f484edcc47040224a2f0513b2962b1ca63b77cc1e2f4a8366b72bf44a
MD5 6dd3177af38500f85c8391bca39911ba
SHA1 08a8a7f54e4c18165cfe70cb2b6edff875aa8f2b
SHA512 1e628c6adaf62638b6058ac9b30cca104f38b9a64555cde69aae20bc44bf9c3067355d581e9bc927cc16779b0ba581635d62c4551c04fd8aedd595097ab4e6eb
TLSH
T1135140E05C7C5AC1D1FD0E7EB09738EC91E8D321B8A4747D2858E9994A7E61D308583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 11cd44bd54a90312a0b99ab981ed03ec6de15fb87cf6b591f069242cd6c8a7f0
MD5 9ca22a39228cfac0eee6738a57f6ba74
SHA1 f748b056e5989aed40d3410befcdf9295db8078d
SHA512 aceeb4e97330f1266d7fec280975d0ddffc22fe59b9355d507cd86d947bc9bbd9bf612412d0ad76ebdb2ea18871a762ca5fa3ff8fadae620eceb14f1f2405487
TLSH
T171513EE05C7C5AC1D1FD0E7EB09738EC85ECD221F8A4747D2858E9984A7A62D308583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 8b6a2416b70c6683e9f0e61c25d8b58d182ab843e28c740c2014934b2bb91f02
MD5 688f0adad5e6c015b822b33682251951
SHA1 e885a82b92d84c5343bc899cef47c954691bd9ab
SHA512 a7da903fa03fe9a096c48f59ad675d647e63d43470b257e827a83c97debb4f88d53311d14f8e2ada5fd2d1438a744dea3f98835cb4899e414f2cbc72debe14b3
TLSH
T1EA413FE05C385AD1D4BD0E7EB09B39EC80EC9721B8A0347D6C58ED988A7A61D2040C3F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 b15de3affb11e07c07b1bcde3c8add4b97658ed794386467d04a07fefe5317bd
MD5 aeff1ad459b5cde9b13b9c521f89d1da
SHA1 0bdf93ae5fe8e6e8a39229db78b52f3c1b0e7f08
SHA512 fbabd5cbb5ca8bd9daededb0351476675f5809491b8330532306542e8d0738e70feec811d67d5e949a30388468ea8b713dc7411235ae4f74148bd8a01d2fafa4
TLSH
T11C413FE04C385AD1D1BD0E7EB09B38EC90E8D725B8A0347D2C58E9989A7E61D348183F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 89ca1777a263ed2d98aeb79d8c30b3e08bbe2b724ceb2332a2a4e32b47b0b53c
MD5 c95821aa03cf78ef9c31c2e72babcf9b
SHA1 045161073c94ab1588f93f6ebb3689a2608bcd6e
SHA512 62bce22b87304e9d4d99747eb859356262844a5fa3cb251fa337eeb1b7c5f40a9f355f2031c7987e0b6565fcca4aed8052727725f5309b3f62b2d5e51b392873
TLSH
T1A5411A58A6FE1148B3B76E5A9BF7A86D487AB8672E06D45D10110E4E0663F40CCB1B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4488-261-0x0000021714F00000-0x0000021715F00000-memory.dmp

Download