00f13ebf8754aaee4bbb23c7c7c9ec0439ecb6afd5c932a856c7cdf79132df42

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/10/2026, 10:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Serenade Punta Cana.pdf
Size 86KB
Sample261001-m3vsxa1sc1
SHA256 00f13ebf8754aaee4bbb23c7c7c9ec0439ecb6afd5c932a856c7cdf79132df42
MD5 68a9deb9b97ccbe299a3501105aa4e7c
SHA1 be8e64807f15ffce18f38e62c6cd5b86234dd71b
SHA512 5b0cce0a1484caf6c82faaf36f546b92b9967893dd766af28c6067aa20c80b241c964a1273b97473c2deaadec3016fe58751fb80609438c4518c79854d59990d
SSDEEP 1536:YeKbgW7AMjWpMXWvnzKfyWliAHN7XLbCdPphZv31mGjNMKemCjz:ZKcWJWGXWfzKhxN7XLmHZJMZJP
TLSH
T172930250BCCC9FC6D807068ADF493C48A97F36D350E45986B36EC1078B9BE9B849609D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware microsoft discovery phishing spyware

Malware Config

Signatures

A potential corporate email address has been identified in the URL 3 IoCs

phishing

description	flow	ioc	pid	Process	stream
Email address	77	[email protected]	5928	msedge.exe	35
Email address	77	[email protected]	5928	msedge.exe	93
Email address	77	[email protected]	5928	msedge.exe	115

Detected potential entity reuse from brand MICROSOFT. 2 IoCs

phishing microsoft

flow	pid	Process
223	5928	msedge.exe
223	5928	msedge.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6012_917176169\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6012_917176169\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6012_454062302\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6012_454062302\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6012_1137410563\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6012_1137410563\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6012_1137410563\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6012_1137410563\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5928	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{21ED8549-B090-4961-905E-ED96B183FEC5}	msedge.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
5668	AcroRd32.exe
5668	AcroRd32.exe
5668	AcroRd32.exe
5668	AcroRd32.exe
5668	AcroRd32.exe
5668	AcroRd32.exe
5668	AcroRd32.exe
5668	AcroRd32.exe
5668	AcroRd32.exe
5668	AcroRd32.exe
5668	AcroRd32.exe
5668	AcroRd32.exe
5668	AcroRd32.exe
5668	AcroRd32.exe
5668	AcroRd32.exe
5668	AcroRd32.exe
5668	AcroRd32.exe
5668	AcroRd32.exe
5668	AcroRd32.exe
5668	AcroRd32.exe
4956	msedge.exe
4956	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5668	AcroRd32.exe
6012	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
5668	AcroRd32.exe
5668	AcroRd32.exe
5668	AcroRd32.exe
5668	AcroRd32.exe
5668	AcroRd32.exe
5668	AcroRd32.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 5668 wrote to memory of 2460	5668	AcroRd32.exe	94
PID 2460 wrote to memory of 3772	2460	RdrCEF.exe	96
PID 2460 wrote to memory of 3824	2460	RdrCEF.exe	97
PID 2460 wrote to memory of 3824	2460	RdrCEF.exe	97
PID 2460 wrote to memory of 6140	2460	RdrCEF.exe	99
PID 2460 wrote to memory of 804	2460	RdrCEF.exe	100
PID 2460 wrote to memory of 5848	2460	RdrCEF.exe	101
PID 2460 wrote to memory of 5312	2460	RdrCEF.exe	106
PID 2460 wrote to memory of 5312	2460	RdrCEF.exe	106
PID 5668 wrote to memory of 6012	5668	AcroRd32.exe	108
PID 6012 wrote to memory of 2896	6012	msedge.exe	109
PID 6012 wrote to memory of 5928	6012	msedge.exe	110
PID 6012 wrote to memory of 2804	6012	msedge.exe	111
PID 6012 wrote to memory of 2804	6012	msedge.exe	111
PID 6012 wrote to memory of 2804	6012	msedge.exe	111
PID 6012 wrote to memory of 2920	6012	msedge.exe	112
PID 6012 wrote to memory of 2920	6012	msedge.exe	112
PID 6012 wrote to memory of 4600	6012	msedge.exe	113
PID 6012 wrote to memory of 4600	6012	msedge.exe	113
PID 6012 wrote to memory of 4236	6012	msedge.exe	114
PID 6012 wrote to memory of 4600	6012	msedge.exe	113
PID 6012 wrote to memory of 4236	6012	msedge.exe	114
PID 6012 wrote to memory of 4236	6012	msedge.exe	114
PID 6012 wrote to memory of 6120	6012	msedge.exe	118
PID 6012 wrote to memory of 6120	6012	msedge.exe	118
PID 6012 wrote to memory of 2116	6012	msedge.exe	119
PID 6012 wrote to memory of 2116	6012	msedge.exe	119
PID 6012 wrote to memory of 5848	6012	msedge.exe	121
PID 6012 wrote to memory of 4252	6012	msedge.exe	135
PID 6012 wrote to memory of 4468	6012	msedge.exe	136
PID 6012 wrote to memory of 3120	6012	msedge.exe	137
PID 6012 wrote to memory of 3256	6012	msedge.exe	140
PID 6012 wrote to memory of 3256	6012	msedge.exe	140
PID 6012 wrote to memory of 2204	6012	msedge.exe	143
PID 6012 wrote to memory of 2204	6012	msedge.exe	143
PID 6012 wrote to memory of 3816	6012	msedge.exe	144
PID 6012 wrote to memory of 3816	6012	msedge.exe	144
PID 6012 wrote to memory of 3816	6012	msedge.exe	144
PID 6012 wrote to memory of 5168	6012	msedge.exe	147
PID 6012 wrote to memory of 5168	6012	msedge.exe	147
PID 6012 wrote to memory of 5168	6012	msedge.exe	147
PID 6012 wrote to memory of 1316	6012	msedge.exe	148
PID 6012 wrote to memory of 1316	6012	msedge.exe	148
PID 6012 wrote to memory of 1316	6012	msedge.exe	148
PID 5668 wrote to memory of 4304	5668	AcroRd32.exe	149
PID 6012 wrote to memory of 3920	6012	msedge.exe	150
PID 6012 wrote to memory of 3920	6012	msedge.exe	150
PID 6012 wrote to memory of 3920	6012	msedge.exe	150
PID 6012 wrote to memory of 2656	6012	msedge.exe	151
PID 6012 wrote to memory of 2656	6012	msedge.exe	151
PID 6012 wrote to memory of 4956	6012	msedge.exe	152
PID 6012 wrote to memory of 5392	6012	msedge.exe	153
PID 6012 wrote to memory of 5392	6012	msedge.exe	153

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Serenade Punta Cana.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5668
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2460
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B45A00536A39C39BC0AB46B954DB9E82 --mojo-platform-channel-handle=1724 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3772
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=A611AA4139774AF9F6DF677EF2E3E9D3 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=A611AA4139774AF9F6DF677EF2E3E9D3 --renderer-client-id=2 --mojo-platform-channel-handle=1716 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3824
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=787FF58D878037185893E110641FE61D --mojo-platform-channel-handle=1932 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6140
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=8F001F9A47CE8160E47EC316DB1CF9A3 --mojo-platform-channel-handle=2300 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:804
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C14FDDA9C2C4D308B11B0CA7983784F7 --mojo-platform-channel-handle=1928 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5848
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=AC3AA0CDB6BE6DAC8584D51A52F1697F --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=AC3AA0CDB6BE6DAC8584D51A52F1697F --renderer-client-id=8 --mojo-platform-channel-handle=1876 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://login.0nline-softline3.nl/?gVGqt-o=am9zYW16
  2⤵
  - Drops file in Program Files directory
  - Checks SCSI registry key(s)
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:6012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x34c,0x7ff8ad02c188,0x7ff8ad02c194,0x7ff8ad02c1a0
    3⤵
    PID:2896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1988,i,8505052476529842835,7722374188685489357,524288 --field-trial-handle=2332,i,9067714306150465987,14375001798105352774,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:3
    3⤵
    - A potential corporate email address has been identified in the URL
    - Detected potential entity reuse from brand MICROSOFT.
    - System Time Discovery
    PID:5928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1756,i,960283745144273123,13834956447403036685,262144 --field-trial-handle=2332,i,9067714306150465987,14375001798105352774,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
    3⤵
    PID:2804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2560,i,8241695890422764831,16062686573095089060,524288 --field-trial-handle=2332,i,9067714306150465987,14375001798105352774,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:8
    3⤵
    PID:2920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,8977916388316155465,16801694586332954036,2097152 --field-trial-handle=2332,i,9067714306150465987,14375001798105352774,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
    3⤵
    PID:4600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,5700782288031278606,13017873529359201599,2097152 --field-trial-handle=2332,i,9067714306150465987,14375001798105352774,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
    3⤵
    PID:4236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,17044650682012217632,12672622235533660035,524288 --field-trial-handle=2332,i,9067714306150465987,14375001798105352774,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:8
    3⤵
    PID:6120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4900,i,1216560632173250601,15443019549354428258,524288 --field-trial-handle=2332,i,9067714306150465987,14375001798105352774,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:8
    3⤵
    PID:2116
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5764,i,14331619892522308432,12111231215571764782,524288 --field-trial-handle=2332,i,9067714306150465987,14375001798105352774,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:8
    3⤵
    PID:2716
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5764,i,14331619892522308432,12111231215571764782,524288 --field-trial-handle=2332,i,9067714306150465987,14375001798105352774,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:8
    3⤵
    PID:5848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,15035962554637315533,15986791227015453923,524288 --field-trial-handle=2332,i,9067714306150465987,14375001798105352774,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:8
    3⤵
    PID:4252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,12704636529654141256,16836324494860371851,524288 --field-trial-handle=2332,i,9067714306150465987,14375001798105352774,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:8
    3⤵
    PID:4468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,4907169624736675924,8288216002766287678,524288 --field-trial-handle=2332,i,9067714306150465987,14375001798105352774,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:8
    3⤵
    PID:3120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,3065382096424147546,14402812661654411119,524288 --field-trial-handle=2332,i,9067714306150465987,14375001798105352774,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:8
    3⤵
    PID:3256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,16302799015833458663,9069802942671733708,524288 --field-trial-handle=2332,i,9067714306150465987,14375001798105352774,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:8
    3⤵
    PID:2204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6444,i,856811086703197013,6038979111785187233,2097152 --field-trial-handle=2332,i,9067714306150465987,14375001798105352774,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:1
    3⤵
    PID:3816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6744,i,8078568155993606120,5121926600952740367,2097152 --field-trial-handle=2332,i,9067714306150465987,14375001798105352774,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:1
    3⤵
    PID:5168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6860,i,16184811530872996985,4222073474324174694,2097152 --field-trial-handle=2332,i,9067714306150465987,14375001798105352774,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:1
    3⤵
    PID:1316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6432,i,10587637725401191730,15006080438388135400,2097152 --field-trial-handle=2332,i,9067714306150465987,14375001798105352774,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:1
    3⤵
    PID:3920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6724,i,9385451365819808545,15458551008766334705,524288 --field-trial-handle=2332,i,9067714306150465987,14375001798105352774,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:8
    3⤵
    PID:2656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6452,i,7502524213572487167,7028826436881016603,262144 --field-trial-handle=2332,i,9067714306150465987,14375001798105352774,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4940,i,7352355633570838965,2848345488640569849,524288 --field-trial-handle=2332,i,9067714306150465987,14375001798105352774,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:8
    3⤵
    PID:5392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://login.0nline-softline3.nl/?gVGqt-o=am9zYW16
  2⤵
  PID:4304

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4352

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

deny_domains.list

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6012_1137410563\deny_domains.list
Size 12B
SHA256 f51a7acfffec56d6751561966d947d3fd199b74528c07dabdcf5fcb33d5b2e85
MD5 085a334bdb7c8e27b7d925a596bfc19a
SHA1 1e4ad53dc335af5c6a8da2e4b4a175f37fafe2f2
SHA512 c883cb43c97a136825c6fd143f539210c234c66f9b76dfd8431f6ff014094e20b9410d7462aadee2344df8ca158def6b9a807e7cadbdfa947f6f8592e7283e34
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6012_1137410563\manifest.json
Size 177B
SHA256 0e9ec9e79542b4a26ff5da5ff91ed23c0fc9d4ee655cc135b64726daafb364a0
MD5 b06cf477c7639438f14301777daaaeb4
SHA1 77f7a86139f01bf8838df12e4c839143c0958932
SHA512 526576792f56bae509e5de7936815bacbdb262884c7b06110b5ad649b8ea8260622eba0244043ee6a972395297cbcbdc830cc105bd2526b619885c6c0ce42ce5
TLSH
T18CC012DFDC509DB119EB4332156D43C4D733CF0B1546450935FB66082E25985C193500
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6012_454062302\manifest.json
Size 118B
SHA256 3f89d5f63524c77efb5facb385319a03aee54129aa22bca5f6061b8654f7bc5b
MD5 064a722d540bb9c42e4db8268426a4e1
SHA1 dbf4fe6aba40365a0646508d6f1f558d767e234a
SHA512 ce6a19905edea82b03cc4b70907393c2fd31e308c9d6e6dac649bdfbf44b04bf0ca2ffc8f0e354784258ef3d0b25bc72655302dca37897c36f0848bc9debe394
TLSH
T196B092B00C1AA03B22849320ECA066C283F80A19E8021B1E088036481F8817881366B2
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6012_917176169\manifest.json
Size 53B
SHA256 7612538ef6ea25a2078adf4ebda2b0565546d80189b6af46bb0e1c9744d720d5
MD5 46b34a0f2dbd5b58337d4cf05bdb4797
SHA1 b190fc81ede34f9fe8f4f5dee1b915331b76cc19
SHA512 49d0691d8eea580f863190f3073552b74bd550ec8b0a1b748fa0c5a18f05a515390735264f62f1aee0590017a1e4e85e470c32bfd49dfd371a47d1493ecab664
TLSH
T1B79002600414921716C10E906571B895A391661955850D1D04551558029586CE150298
MD5 SHA1 SHA512 TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
TLSH
T178F21D566E241E3CCA9EC336340836C34D78023DACF3B762A58A719747AD181E37D6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
TLSH
T1C94379DF2A348110CA0768BABD71771BB655D0BFC1C2F0A87AD68A1780B463CE775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 e92c4beab634ff5d1eba8305dfd6d24dbd72f9e7cf1500ffde64a75676894a96
MD5 b16b65197c0e3b0059cc9f32bfb0b7f9
SHA1 fb6f6591ce87e8c99b9bd754b8398f1566de634c
SHA512 3f8178a1229030084f96040a7f3156c69a24e95c06d36cd6bde879e518aac5c305be41bdfda264c3ed17038de1facb3746d94217ac72afe0bed4beb274b3cf8a
SSDEEP 384:yeYdThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:T+eUZsLQCZsL3hUS4
TLSH
T16E53CBDB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 e4ede93a7b699206693f2e666f3e9670bdbfd5a2bf5d8592c400ea87fb549021
MD5 1f7ee2c5ad394015a4e0622d2e550318
SHA1 20badeb95027dd9f0503a4e9bfdade4bc8ca9993
SHA512 f2a37cf83c39ef07e9453f89802a2ec0afdd9a77dd54e6894b3bb54476ae9549c069398eb10c9649fdcd4011c7d3888e1e42c4dc8c566911470710cedc1e4350
TLSH
T14251B44896ACC393D7E9DFB08DE166C73A30F672AA639E130798D5B8AF727457302044
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3666791ece092c372d143873bba44ed4622c1769c8d6c2ed11d1f8547373b810
MD5 51368dfa8b26a08a3fe7e2783a8c81cd
SHA1 da1110202caf33a5c2a1bd30f87e5a09c01009df
SHA512 2f10b2d17e5f6c0f75dd6c6a8e46cc668cafbae4c30a00ee5c1989b19e0102fba1b2681c98effdfd9e74f8c7b891f217b40c2703d86ec33683db036274e94117
TLSH
T1D151C804966CD393D7E9DFB08DD166C73630F6B16A635D130798D5B8AF727457302044
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 b67c6140d874b2d2d97fbd4faadadc8b8d81543c6679e3be1b7f1771eb95160a
MD5 77bbb16ac828731f82b019eecb8c4638
SHA1 2244c6e0620bcaf7417ad7d6af1320a164f8d7f3
SHA512 0e8b688af016a4196e065c28097cf86ed0c9691b924032a36083d25a82bcee8eced3dbc825767f93db51a132912d56ec7445a1963cef95ff423c8d598feece74
SSDEEP 192:D1v0Wk3vrnlFaLrKGxrRT7i8n/oX+dLoSffT:D1v0Wk3vrnlFaLrKGxrRTu8n/oOdLoSD
TLSH
T1E1D1CDA2C2D4869DC92126F1AB14BA1AFE1A0F2543AC3D0FC5E5DF9FB3E1474E64051E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 da523175b96e04113cec5c0c82bcfa6dde223793580ab28853360fd8182cf786
MD5 3cadbaf0db42d3ca226f248d49c05a99
SHA1 591bd8345aecc2df6bf31cafaddd1e1aaa4e78c7
SHA512 cc1b731afdf145377dffb4c7031cecd399635b56c2059173d54d2b340cbf9fb5dd40ba7b2d52d7117f97faba8e5924aaa22e27df28dd9eca9034994b7bf231b2
SSDEEP 192:sxZJRwjP/f8sxGQZLjN8NzodpFCTHW6+WNuTstxYoipSX2qIg5JHdtEJ:sxZJGP/f8sxGOPSGOHbLxgSGqj9tI
TLSH
T16252E805AD28687B8CC7D21DFB19BF52E3F9503395811E48AAFC8A2C14EB6DD620741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f8e87ac9bce33064161bb17d2e3b4e04ac5033972997311f6e0ece723ab1ab4c
MD5 1cd093408534da7352c4a83c225ed414
SHA1 d31d6c780c9999e12095f5d05d1c36f328728d2b
SHA512 6fbf4e4ef3c01d8b69d91e78fbe432557b1302d1924fe752931afa43ba2d42647ea60b5fe0b05fb17517414287818017f77662d1a457716c480a32573bb6d322
SSDEEP 192:sxZMRwjP/f8s6LaQZLj/8NzodpDMHW6+WNZ6y/Yo6pSX2qIgjtWJ:sxZMGP/f8s6OOPUGoHbF/QSGqjti
TLSH
T1B842FA05AD28A97B8CC7D219FB197F53E3F9503394911E48AAFC8A2C14EB6DD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 28c88cc313891c9d90524eafe81372bbaab7a285e495b30af05c4cfded9972f0
MD5 dddcc71e6265ef960b9408f06f3f6667
SHA1 823bbd741c17c7ca72400bc4694af2aebc2c1882
SHA512 eda8302331ac6115387e9bb5d56f33c4163dfac9372f1ce39edf3d13cd31c29d076073b29dc376848d2afa0cad2a2068af736764cc12da458d01385b5c96027a
SSDEEP 192:sxZMRwjP/f8sxLaQZLjY8NzodpDMHW6+WNZ9qXYoppSX2qIg5JVtWJ:sxZMGP/f8sxOOPPGoHb6XVSGqjVti
TLSH
T1AD42FA056D28A97B8CC7D219FB597F53E3F9503394911E48AAFC8A2C14EB6DD620341F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f85dcfcb92ab59722462f7d90bf1e8e0c43074ea6b7c06ed53fdd868da6fe26f
MD5 8e952ed1a4ba41297e828a83b6a0dcdf
SHA1 e585e57a38f9dccce19674a81a5edaa3a09138a1
SHA512 f68e9c80e6709456048aac2ac371a6c3accf6b54bbcda4dcf52e1cd50229a6011781015e014416507efbe2905d9d3647e5eea71a2c6027e140b0913c972b472e
SSDEEP 192:sxZMRwjP/f8sxGQZLjY8NzodpDMHW6+WNZ16ZYoppSX2qIg5JHdtEJ:sxZMGP/f8sxGOPPGoHbiZFSGqj9tI
TLSH
T14B42F945AD28A97B4CC7D219FB59BF53E3F9503394811E48AAFC8A2C14EB6DD620341F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 2de6945903a63f76423ce58c8f591c515e7010d5e7f40edcf2904f7cf7327f9b
MD5 228274938497b8e32d551131d02b040c
SHA1 c724750e70179f3df3b12066fc6001f0a4c4b561
SHA512 34a36c741b01bcba9e5469e448abede10f09ec6e1e547c06baa401e7bf1fd5d9515d870d7f1fd278b26fcf21d5b3fe2a70720b349672ed083d7c5b2f81124cbf
SSDEEP 768:Px6r8sW7pLuLbG+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVP1qpLlvVajYroD:Px6r8s2EbG+WviyUKu1jau1qpLd4jjoK
TLSH
T10DE2F97B780CCE7E4FC04A9DDD1A7F8B6DA802CB9698C95087FA945C02C67EA51170DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 2a98f427a3db85b01c0f1be2b28622bbaec2b471e7a0d70430d70183138d788f
MD5 6f2ac136a834b9075f8a84936c738e9f
SHA1 43a3562a606e2dbad3b6ce6628d5491ed952b429
SHA512 053ac2ee85bcecd6e1008b0792390cf4e3feb1beb1aa7649daf4ec2dde672d818f49fd75da10f16b7078ae95165cf78f4be81b39544946adb391f85935bf6950
SSDEEP 96:KM8wKFqmq2sK3qsrWKIcKKsAKVK66QKTywO3aKoErbWKY0KGnuKc82DOhVLZZdgg:ST/2dXOJhJlpfnpp3tNXVrN3gT1/
TLSH
T10BB21F1571BB421039FE391892B59B6E068271733119E66B7FBD00B68E2BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e70857ae-eaf4-4c2e-b13b-ffba537eda58.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e70857ae-eaf4-4c2e-b13b-ffba537eda58.tmp
Size 649B
SHA256 547d30a61361ab729a94ae1f43083ae7b30356494602f983013c85ff774e48b3
MD5 e88f04ea8c34b9b938b730c93a7c29c1
SHA1 6426156d75cd6a9e8cfdd516f9ec266f6345d438
SHA512 2b3757f983b15e430a51ee394db8d0f3c9a5bd2619f0c0c2b6bd8678dde6cce53af4e3d8f89b0f84131bab540fda3ec6a44ddefc3ee67652e3c2b7b975a9fa64
TLSH
T159F0F9B5D921BC3B08FD1B2960940746F750236B2A51984B3B3D851C4FB4637494585C
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.25\data.txt
Size 152KB
SHA256 4e932235a6fefae59866c98f69253bf2d3d0e7e2a2a9ae546685bc4646f9a297
MD5 b5394eb229ba53caf4fc321b5087e299
SHA1 b84ae45b51a9d200639a10ea487b1ba9b94ed3eb
SHA512 6e6f890c6fc57d470e2bedaf5b022d13e54762c8d424a4a43493b7eb68f2d22be2a1641f5ffa25a1756fef938841ec50c908e97161da28158a2c7e3b258b39d0
SSDEEP 3072:wPAgDcCHaLHl65aynyosxb3+BLvf55rOiWF4Vkia/UFwK:cX1aI5aZoKzMDXrOiW1igUB
TLSH
T1AAE3F240C9D0AFDDCEA8161C90BE0F1963E1CA8EC13A958ADB23FD4B6FD3A045A175D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 7ad05bec4ad30fb62499ebf9c98f74aa0b54380f86ce036b5701ba6e720529a7
MD5 d04d0f3ab107ea888595e007543b540a
SHA1 9d7beda6777a2b2c28dd3bb1b0a10b6a0bc2bed3
SHA512 3e1b160f571f6a384235a2c36f89919fb7fd4b0bb4e436c3128867ee3956fbd82b0c57c60b7a07e25c8ab2b87793d7719fc482ef7f246699f4e8454075a3fda6
SSDEEP 384:nXiFiZcIV3sNm8TUNTUlI4oaKM602w2fLBCc8ibqRKQl/sqctuiRVZh6DKhH+/qi:SFQV3TwgQTWBCcX8KQl/nBiRfYGHt2
TLSH
T134C25B32EC98DEB7ECEA4BD5F7093643DEE451A3998C9AC4D9D85D1C008719D170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 c88db21712d70bc2e1654443f1a2c6ed23b5aee6c2499618d276c69e17760d3c
MD5 fb18f54df1544e0babc8f093d4c9dea4
SHA1 f829d9f26e9340938af76832845efe707779043f
SHA512 71a9e096ab673b52a3ccc0d848e9eec79ae15d39c816ef7ea1ae92e134a3b7a0e6063f68e4cf2570ee82a3212fe0aff76bb0c74ac033f589b2a53e648299f75f
SSDEEP 384:n8iFiZcI63sNk8TUNTUlIm2aKMis4w2fLBCc8ibqRKQl/XFesa+VYsTgL/7Iz3o4:nFQ635wgchoBCcX8KQl/XFehgNr
TLSH
T1EBC25A32EC98DAABE9FB4FD6A74A7613DEF00263959C96C4CAD81D1C10D719D1307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 92ca578412615e718bc23c22b6093d3239d7fbeca69cb39b79cc777d4d54a5f7
MD5 a9e1c7609e69f93535e519db27e5e5c9
SHA1 1b4851c183f876bb41a3d8c79201603ce6d42419
SHA512 30f3e05ec9dab6420d713ffe3ebe0ab074678c4c1eb729899b6037e797b8bba11bb393a441e6f5e28ac6ebd3aef883eac6104139f68cfea17ed9a34b1788ca46
SSDEEP 384:n/iFiZcIV3sNm8TUNTUlI4GfaKMo02w2fLBCc8ibqRKQl/sqctYiRVZh6DKhH+/+:KFQV3TwgLydWBCcX8KQl/n1iRfYGHG2
TLSH
T1E1C24B32EC98DEB7ECEA4BD5F7093643DEE451A3998C9AC8D9D85D1C008719D170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 69375fbacd90b7ec2751d01b0e171539773e318b4a901dbd916447c17b81c217
MD5 7f3b251425b217ff9685f398a99053c2
SHA1 0b9426895e9aea9407e1a25e8fa683719caf8c39
SHA512 99b7766c997a5febfb8c6b257469ad77b24bfc595d47214624c4f62468c15e9aed584cba5bc3b5c8f86ceb27257efd1447799a0caeaa3a6ceee40cf980473809
SSDEEP 384:niiFiZcItb3sNm8TUNTUlI4GfaKMop2w2fLBCc8ibqRKQl/sqctUmRVZh6DKhH+G:pFQh3TwgLyoWBCcX8KQl/nZmRfYGHG2
TLSH
T12FE291F198DB99B6D8AE4B87A73D2E0299FCD153B4884A84F7D41D1CCC861BFD306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 d19c26e763e32f906dc851e6e94cb60c4e64fb64c6d6d481847a25cae632358b
MD5 f3de395742fe92efa6140a23126b79e3
SHA1 d52143e5a009687e0a98fea01c932881f9cf6a37
SHA512 e109cea5e42b84b0bd58df5cc9eb4ffd6bc77310a4d3601af55c9b9bc61ed85eeeae5582e986e690c8a6058105dc936a20f9d19d39c4c5e97d0cc8cd1e0077e1
SSDEEP 384:niiFPZcItf3sNi48TUNTUlI4SfaKMsp2w2fcBCc8ibqRKQl/sqct7mRVZh6DKhH9:pFHR3T4wgnyYdBCcX8KQl/nemRfYGHG2
TLSH
T1E3E280F198DB99B6D8AE4B97A33D2E0299FCD163B4484A84F7D41D1CCC861BFD306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 abc0f291c538aa24aa8ee85e3dbb7cbaa3fbe9baffb900c919663392fdc2700d
MD5 a88d938a32d30bd659cccc5558a33c55
SHA1 5d9fb8eecd53586d1d44f24ef66b4a3d35a8f3a0
SHA512 043e6c61ddb4d186d828d82090152f9c625e3b514d8463dd679d58799a0e7ced996443ef740a7599b9417ac289232cdad349038ce69db68fb8e3bf44b035d28c
TLSH
T168E00211930054EFC118133101835F203FE1C13113F2038B5770067D5C333103E20AC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 e6634df90de299cd9fb4db865001e63bc4e2db1d783bef1bd924433ee4684024
MD5 1a1d78a65034a6cfcb4b53407425efb8
SHA1 434f5ee61d9776444c2ee990983cdecd8cda3943
SHA512 934b86e662eb81c29032e0454299a101956d38bc7d0eac350ba769018536b3bea7dffdf25d847b52d797817a0cdc8daa0b771f91abdbf5348907b4b23fb002d6
TLSH
T1EAE00121931054AEC129133201835F303FA1C22113A2038B9670056C6C323153F20AC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 6eb59272105b5b0650a9dd1ea4034d3f8a92c33a77bf746a3e18ca3ffe212ade
MD5 2a45a21cc081ccc00c4a33c8bae514d6
SHA1 57ac5c28daeb87e587ac4c875611a1ab407f6442
SHA512 d4e09e95b8f39245ea0f9d4147f03cc1478c6cd274e4d1257e33d71f57878be60c797256d1b5883aa2d30829d37efd4c93d26252a0d75d904f8f8004b812dda3
TLSH
T1BAE00122D31065DFC129133201835F303FA2C23113A3038B9A70057C7C327153F20AC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 c3e6fba5e8f501c47f11399ba792def16513b20f1e3248bff0238a835e98a2de
MD5 1e409471b5fbc912c2ce3eebc8f4eb34
SHA1 f35b33c6f68432310ff02620b9e3202fa59e3f9e
SHA512 182d1688de264fa4ab57653391419649d505b3d7af9abf0544cf45d41c63efcf7bd0862037136a66b6c6b629c6cee59da27ecf96f79c9270b0b6ae0f56fa3b64
TLSH
T1CBE002115300548EC110033001835F203FE1C111126203475670056C5C323103E00280
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 760062d9b93637933a440cdc9905f13292d3ca00df04b995b14cad17254580c5
MD5 4453b90ec104c38d8e6f25e57564f61d
SHA1 638d421ccd8da8fddb406573a135dc08022be31f
SHA512 4c1c5a61f722d9ae8a03bd31f4196d37b4dd410211b3fb1caa5c55ea65539e1d351a949b72fd61c50070fd39ec5c024a0cc98df27388501a98c3a65d8a1e6025
TLSH
T11CE00922E311659FD125133206875F313FB2C23113A3138B9A70057C6C227152F20AC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5a28e6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a28e6.TMP
Size 392B
SHA256 c8c2f60ef1ec366519478c24503d47a287874dd0fce3b5a540c24296962bb9d2
MD5 f35f41c9dd70ab469661274ec8337eee
SHA1 13484595ccb8dd97ad3346d5310bb4cc205ce62a
SHA512 633939497c0cf66df0de56264c7962655cfc1866e75f76732f13d70d70902725ead972d137bc3f2eaf4c75162bb556c1e1de5cf78f13301755447988ba3fe9bd
MD5 SHA1 SHA512

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.9.30.1\typosquatting_list.pb
Size 1.4MB
SHA256 5435d91bee48abb353a7d203b4b7eecac6d2901a96fd0c934fcc8ecf173e5563
MD5 5bff34d92fc5a86bef266b458a6efc08
SHA1 95e2c2b9d976cb7855d6f7092ecb0cb241617182
SHA512 02625a49261c12154ebe377df81d4457ba449801273dcb27d742dfea86329b1da7088484467ff9ab6dae4e649783201a58efb9fbad630c0e29d1191b2ccec20d
SSDEEP 6144:NwUhpkDDI4SQRKjrKu5ujaJ+jb+1zIs4nKvL0+7rbKQPCL/LsBjeLXgJ1NCry25u:NtpiDI4daZHlIXKNYYZfdhvn8RZJcv+Y
TLSH
T1B365B5B9DFC00194DBB8112D20BE71D8181412A540E9DFEAFE7C855F2BC6AC977E85E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 6406ef8579ee45ec3e15db4712b2798b55228d5642b270c7364107fb466b678b
MD5 680b5906b1dc40f5b7414cebbad44a6a
SHA1 a5f722b7b3202db3a70eb7cb98d32079a559da92
SHA512 a5ffb3b116f94c638f9f7ade2e8af91913da664b7633d50bce0a9a8aa7dce921ea33043c1c77af8882220f8859d8a758e7f551f5ea544b03490a0ab100ef0b7e
TLSH
T1EA512DE04C3C5AD1D4BD0E7EB49B35EC95EC9621B8A434392858E9988A3AA1D3084C3F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 eca2084175ab635d925577691d9ad246a22dec9834466eb384e6a4c6292df7b6
MD5 f6a9eddf2a3b404cb9de79efea17c3cf
SHA1 7983da215bc23a42f24a4926efd76bec6783c55a
SHA512 e59bf041b47554f6e25eb6ee0776825ae9e88de12bf2b56a4b8bef6b5cdc1682f4b4d8581ffb5d922d15a4bc1263bb29c1be5df700afd0f04528230317b61eab
TLSH
T100510DE05C3C5AD1D4BD0E7EB09B39EC95E89621B8A434796858E9988A7A61D3084C3F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 03bfbe358eb8ae211232d2dc03bfd5078bdd5690c4b1c236b0ffca15186bcd08
MD5 dc3f5905562a695ebdc0f12224adfb4a
SHA1 18789283151d556123a474b2f7bde56eb785b678
SHA512 7702e7451492e5f0a813620a99a4c969137be76d37a691ec27907154e89d27763c09d880dcf89589859ef64ccd59f941707639c5f2d9218da37b32635d51ddfe
TLSH
T1EE41F558AAE91148B3B77E56ABF6686D487FBC372E47C49D00110D8F0A63B44C972B37
MD5 SHA1 SHA512 TLSH

Submit Download