202460e34cdb373500d6ab0f736fb5fac03cbe75a551ae00df0ac469efb0144e

Resubmissions

14/10/2026, 03:52

261014-eff28sfy3k7

14/10/2026, 03:47

261014-ecep1afs3z3

Analysis

user interaction
yes
max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/10/2026, 03:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RFQ_WI_COSU_NJ17010.pdf
Size 44KB
Sample261014-ecep1afs3z
SHA256 202460e34cdb373500d6ab0f736fb5fac03cbe75a551ae00df0ac469efb0144e
MD5 349ccf3d61cb2e329f8ba622eee7732a
SHA1 393210dbccc710cab819d2cdf83c1cc5cd0f73a2
SHA512 de1385dad7d282761d6f23745e9fff2fb9ee9d0f866319ecc11362b66b8f43e790390c6aab6df5af7c6edff6ee8df6f9c51cac29a062ce45d2ae3a31deb57bd6
SSDEEP 768:f9Za7lmdbABZWckNYfhAFf/pvx5TlUhcZCYgubq4zPh/GwlhdnfF9BzzGEZHkoFq:jolblkiJ0hvyhsCTubZLh/99N91ymEG+
TLSH
T10C13F1A6F62EE449C84BC783E15D32AC0C48F64EBAC834D39CA54342DC57749ABF5AC4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

System Time Discovery 1 TTPs 6 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5940	msedge.exe
3040	msedge.exe
4884	msedge.exe
5448	msedge.exe
4736	msedge.exe
1732	msedge.exe

Checks processor information in registry 2 TTPs 14 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 18 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-524788801-3318743092-4051225893-1000\{FDA8D164-1E55-44A5-B7B4-A052B6EF3A96}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-524788801-3318743092-4051225893-1000\{184872D6-F159-4D72-91BB-9F01AAFDDD74}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-524788801-3318743092-4051225893-1000\{7555EBC3-ED71-4DB1-93D3-223BD46F1A68}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-524788801-3318743092-4051225893-1000\{7E5CEB0A-EB73-459E-B640-38E7328055FA}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-524788801-3318743092-4051225893-1000\{979B83BC-369E-4965-B600-554DFCA45A32}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-524788801-3318743092-4051225893-1000\{41202B40-C7A2-4A6F-BC71-5D59E88F422E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4808	AcroRd32.exe
4808	AcroRd32.exe
4808	AcroRd32.exe
4808	AcroRd32.exe
4808	AcroRd32.exe
4808	AcroRd32.exe
4808	AcroRd32.exe
4808	AcroRd32.exe
4808	AcroRd32.exe
4808	AcroRd32.exe
4808	AcroRd32.exe
4808	AcroRd32.exe
4808	AcroRd32.exe
4808	AcroRd32.exe
4808	AcroRd32.exe
4808	AcroRd32.exe
4808	AcroRd32.exe
4808	AcroRd32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

pid	Process
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe

Suspicious use of FindShellTrayWindow 13 IoCs

pid	Process
4808	AcroRd32.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
5536	msedge.exe
5536	msedge.exe
1844	msedge.exe
1844	msedge.exe
4680	msedge.exe
4680	msedge.exe
4252	msedge.exe
4252	msedge.exe
5940	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4808	AcroRd32.exe
4808	AcroRd32.exe
4808	AcroRd32.exe
4808	AcroRd32.exe
4808	AcroRd32.exe
4808	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4808 wrote to memory of 3076	4808	AcroRd32.exe	93
PID 3076 wrote to memory of 1340	3076	RdrCEF.exe	94
PID 3076 wrote to memory of 1268	3076	RdrCEF.exe	95
PID 3076 wrote to memory of 1268	3076	RdrCEF.exe	95
PID 3076 wrote to memory of 4052	3076	RdrCEF.exe	97
PID 3076 wrote to memory of 2092	3076	RdrCEF.exe	98
PID 3076 wrote to memory of 2092	3076	RdrCEF.exe	98
PID 3076 wrote to memory of 2704	3076	RdrCEF.exe	99
PID 3076 wrote to memory of 1640	3076	RdrCEF.exe	101
PID 4808 wrote to memory of 3360	4808	AcroRd32.exe	109
PID 3360 wrote to memory of 4028	3360	msedge.exe	110
PID 3360 wrote to memory of 1732	3360	msedge.exe	111
PID 3360 wrote to memory of 4408	3360	msedge.exe	112
PID 3360 wrote to memory of 4408	3360	msedge.exe	112
PID 3360 wrote to memory of 4408	3360	msedge.exe	112
PID 3360 wrote to memory of 3800	3360	msedge.exe	114
PID 3360 wrote to memory of 3800	3360	msedge.exe	114
PID 3360 wrote to memory of 4328	3360	msedge.exe	115
PID 3360 wrote to memory of 3424	3360	msedge.exe	116
PID 3360 wrote to memory of 4328	3360	msedge.exe	115
PID 3360 wrote to memory of 4328	3360	msedge.exe	115
PID 3360 wrote to memory of 3424	3360	msedge.exe	116
PID 3360 wrote to memory of 3424	3360	msedge.exe	116
PID 3360 wrote to memory of 3028	3360	msedge.exe	117
PID 3360 wrote to memory of 1192	3360	msedge.exe	118
PID 3360 wrote to memory of 1192	3360	msedge.exe	118
PID 3360 wrote to memory of 1192	3360	msedge.exe	118
PID 3360 wrote to memory of 3028	3360	msedge.exe	117
PID 3360 wrote to memory of 3028	3360	msedge.exe	117
PID 3360 wrote to memory of 3040	3360	msedge.exe	121
PID 3360 wrote to memory of 3040	3360	msedge.exe	121
PID 3360 wrote to memory of 3504	3360	msedge.exe	122
PID 3360 wrote to memory of 3504	3360	msedge.exe	122
PID 3360 wrote to memory of 3504	3360	msedge.exe	122
PID 3360 wrote to memory of 2696	3360	msedge.exe	124
PID 3360 wrote to memory of 2696	3360	msedge.exe	124
PID 3360 wrote to memory of 4696	3360	msedge.exe	125
PID 3360 wrote to memory of 4340	3360	msedge.exe	126
PID 3360 wrote to memory of 4696	3360	msedge.exe	125
PID 3360 wrote to memory of 4340	3360	msedge.exe	126
PID 3360 wrote to memory of 5192	3360	msedge.exe	128
PID 3360 wrote to memory of 5516	3360	msedge.exe	129
PID 3360 wrote to memory of 5516	3360	msedge.exe	129
PID 3360 wrote to memory of 5528	3360	msedge.exe	130
PID 3360 wrote to memory of 5528	3360	msedge.exe	130
PID 3360 wrote to memory of 5728	3360	msedge.exe	131
PID 3360 wrote to memory of 5728	3360	msedge.exe	131
PID 3360 wrote to memory of 5772	3360	msedge.exe	132
PID 3360 wrote to memory of 5772	3360	msedge.exe	132
PID 3360 wrote to memory of 5268	3360	msedge.exe	133
PID 3360 wrote to memory of 5268	3360	msedge.exe	133
PID 4808 wrote to memory of 5536	4808	AcroRd32.exe	135
PID 5536 wrote to memory of 5412	5536	msedge.exe	136
PID 5536 wrote to memory of 5940	5536	msedge.exe	137
PID 5536 wrote to memory of 5928	5536	msedge.exe	138
PID 5536 wrote to memory of 5928	5536	msedge.exe	138
PID 5536 wrote to memory of 5928	5536	msedge.exe	138
PID 5536 wrote to memory of 5308	5536	msedge.exe	140
PID 5536 wrote to memory of 5308	5536	msedge.exe	140
PID 5536 wrote to memory of 3620	5536	msedge.exe	141
PID 5536 wrote to memory of 3620	5536	msedge.exe	141
PID 5536 wrote to memory of 3216	5536	msedge.exe	142
PID 5536 wrote to memory of 3620	5536	msedge.exe	141
PID 5536 wrote to memory of 3216	5536	msedge.exe	142

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\RFQ_WI_COSU_NJ17010.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3076
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F29D8880388FE30E58DAC588BCC014BD --mojo-platform-channel-handle=1736 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1340
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=7E1BA11C7DEE94F4FCA95E58B4393326 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=7E1BA11C7DEE94F4FCA95E58B4393326 --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1268
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=644B8881D8420B948B7E8C459F719D94 --mojo-platform-channel-handle=2296 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4052
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=0156AFA654CA1D18A9329D5125D06411 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=0156AFA654CA1D18A9329D5125D06411 --renderer-client-id=5 --mojo-platform-channel-handle=2408 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2092
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=BB04FBE1D26397A9122BECBCC2605F81 --mojo-platform-channel-handle=1948 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2704
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9345D3FCCF83764FA0CBB3158F7502E1 --mojo-platform-channel-handle=1724 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://links.notification.intuit.com/ss/c/u001.ENblyVYE1020jPfKoSou9rBH58m730z_oA6FFSfZv51z5t8YC4iZx_EzuxCzTS5qgm3_2DK61UEGOuSBRgaTYHj9-liXWBqt7IJGJw2CvYw/4up/00sYqsExTDahz8BOzTAH3w/h0/h001.ALwrPKHfSvc4FPjwQ4FlZRdL8IBi1BkAb6luR0vjWq4#
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2cc,0x2d0,0x2d4,0x2c8,0x2c0,0x7ffb8bf1c188,0x7ffb8bf1c194,0x7ffb8bf1c1a0
    3⤵
    PID:4028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,3573819300704587999,7149250217806123223,524288 --field-trial-handle=2332,i,4633192258691840087,8374849567300680949,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1768,i,18379141113896928130,153968627870405831,262144 --field-trial-handle=2332,i,4633192258691840087,8374849567300680949,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
    3⤵
    PID:4408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2656,i,6391936142736369474,3379330364490698320,524288 --field-trial-handle=2332,i,4633192258691840087,8374849567300680949,262144 --variations-seed-version --mojo-platform-channel-handle=2784 /prefetch:8
    3⤵
    PID:3800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,8302200664843552223,2413318793915447441,2097152 --field-trial-handle=2332,i,4633192258691840087,8374849567300680949,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
    3⤵
    PID:4328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,1928939555395556318,18246999432112656628,2097152 --field-trial-handle=2332,i,4633192258691840087,8374849567300680949,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
    3⤵
    PID:3424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,12080010941370096573,2807008660606632696,2097152 --field-trial-handle=2332,i,4633192258691840087,8374849567300680949,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:1
    3⤵
    PID:3028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,7637253234925674127,16516419412717136532,2097152 --field-trial-handle=2332,i,4633192258691840087,8374849567300680949,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:2
    3⤵
    PID:1192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3668,i,15770329200111246018,10784792548890541980,524288 --field-trial-handle=2332,i,4633192258691840087,8374849567300680949,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:8
    3⤵
    PID:3040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3680,i,1145869487073218158,6801508585704454177,2097152 --field-trial-handle=2332,i,4633192258691840087,8374849567300680949,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:1
    3⤵
    PID:3504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3596,i,5913794135784014142,10765589333111241355,524288 --field-trial-handle=2332,i,4633192258691840087,8374849567300680949,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:8
    3⤵
    PID:2696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3528,i,6128810301689921675,6473504546073147376,524288 --field-trial-handle=2332,i,4633192258691840087,8374849567300680949,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:8
    3⤵
    PID:4696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3584,i,11287754845714412684,9994434340160354584,524288 --field-trial-handle=2332,i,4633192258691840087,8374849567300680949,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:8
    3⤵
    PID:4340
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,13241984617296204386,7686391501086091462,524288 --field-trial-handle=2332,i,4633192258691840087,8374849567300680949,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
    3⤵
    PID:5124
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,13241984617296204386,7686391501086091462,524288 --field-trial-handle=2332,i,4633192258691840087,8374849567300680949,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
    3⤵
    PID:5192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,14033754933822325156,1136509214646839911,524288 --field-trial-handle=2332,i,4633192258691840087,8374849567300680949,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:8
    3⤵
    PID:5516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,8452538205796401641,4317529169131158246,524288 --field-trial-handle=2332,i,4633192258691840087,8374849567300680949,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:8
    3⤵
    PID:5528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,11517024293428778313,16818934516924945319,524288 --field-trial-handle=2332,i,4633192258691840087,8374849567300680949,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:8
    3⤵
    PID:5728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,14453916641650129559,11109812722914086259,524288 --field-trial-handle=2332,i,4633192258691840087,8374849567300680949,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:8
    3⤵
    PID:5772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,1832032764702139001,9400200086374392045,524288 --field-trial-handle=2332,i,4633192258691840087,8374849567300680949,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:8
    3⤵
    PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://links.notification.intuit.com/ss/c/u001.ENblyVYE1020jPfKoSou9rBH58m730z_oA6FFSfZv51z5t8YC4iZx_EzuxCzTS5qgm3_2DK61UEGOuSBRgaTYHj9-liXWBqt7IJGJw2CvYw/4up/00sYqsExTDahz8BOzTAH3w/h0/h001.ALwrPKHfSvc4FPjwQ4FlZRdL8IBi1BkAb6luR0vjWq4#
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ffb8bf1c188,0x7ffb8bf1c194,0x7ffb8bf1c1a0
    3⤵
    PID:5412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,9977910135385436924,2176649444948167655,524288 --field-trial-handle=2280,i,10215086905655686353,9829720144169270094,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,7905770888809948468,4741488914803807215,262144 --field-trial-handle=2280,i,10215086905655686353,9829720144169270094,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:2
    3⤵
    PID:5928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2416,i,5832920925873390825,8592725463271180993,524288 --field-trial-handle=2280,i,10215086905655686353,9829720144169270094,262144 --variations-seed-version --mojo-platform-channel-handle=2716 /prefetch:8
    3⤵
    PID:5308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,12192951821845309089,16957342132007415059,2097152 --field-trial-handle=2280,i,10215086905655686353,9829720144169270094,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
    3⤵
    PID:3620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3412,i,16522185859813621644,14275832382393089489,2097152 --field-trial-handle=2280,i,10215086905655686353,9829720144169270094,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
    3⤵
    PID:3216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=1712,i,7489349403073516490,259301670636815189,2097152 --field-trial-handle=2280,i,10215086905655686353,9829720144169270094,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:1
    3⤵
    PID:5312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3740,i,18112473501282305261,12998608267806963622,524288 --field-trial-handle=2280,i,10215086905655686353,9829720144169270094,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:8
    3⤵
    PID:5448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3728,i,10217546117717934125,2883486848999929680,524288 --field-trial-handle=2280,i,10215086905655686353,9829720144169270094,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:8
    3⤵
    PID:5440
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,393003729733336976,9079054226226417328,524288 --field-trial-handle=2280,i,10215086905655686353,9829720144169270094,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:8
    3⤵
    PID:4328
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,393003729733336976,9079054226226417328,524288 --field-trial-handle=2280,i,10215086905655686353,9829720144169270094,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:8
    3⤵
    PID:3488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://links.notification.intuit.com/ss/c/u001.ENblyVYE1020jPfKoSou9rBH58m730z_oA6FFSfZv51z5t8YC4iZx_EzuxCzTS5qgm3_2DK61UEGOuSBRgaTYHj9-liXWBqt7IJGJw2CvYw/4up/00sYqsExTDahz8BOzTAH3w/h0/h001.ALwrPKHfSvc4FPjwQ4FlZRdL8IBi1BkAb6luR0vjWq4#
  2⤵
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://links.notification.intuit.com/ss/c/u001.ENblyVYE1020jPfKoSou9rBH58m730z_oA6FFSfZv51z5t8YC4iZx_EzuxCzTS5qgm3_2DK61UEGOuSBRgaTYHj9-liXWBqt7IJGJw2CvYw/4up/00sYqsExTDahz8BOzTAH3w/h0/h001.ALwrPKHfSvc4FPjwQ4FlZRdL8IBi1BkAb6luR0vjWq4#
  2⤵
  PID:5968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://links.notification.intuit.com/ss/c/u001.ENblyVYE1020jPfKoSou9rBH58m730z_oA6FFSfZv51z5t8YC4iZx_EzuxCzTS5qgm3_2DK61UEGOuSBRgaTYHj9-liXWBqt7IJGJw2CvYw/4up/00sYqsExTDahz8BOzTAH3w/h0/h001.ALwrPKHfSvc4FPjwQ4FlZRdL8IBi1BkAb6luR0vjWq4#
  2⤵
  PID:5668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://links.notification.intuit.com/ss/c/u001.ENblyVYE1020jPfKoSou9rBH58m730z_oA6FFSfZv51z5t8YC4iZx_EzuxCzTS5qgm3_2DK61UEGOuSBRgaTYHj9-liXWBqt7IJGJw2CvYw/4up/00sYqsExTDahz8BOzTAH3w/h0/h001.ALwrPKHfSvc4FPjwQ4FlZRdL8IBi1BkAb6luR0vjWq4#
  2⤵
  PID:5348

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4796

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5304

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffb8bf1c188,0x7ffb8bf1c194,0x7ffb8bf1c1a0
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,2617107190053767324,12413236024655621256,524288 --field-trial-handle=2264,i,14849220181886750859,4535162500649787448,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,18353013428696526112,8493581156910528593,262144 --field-trial-handle=2264,i,14849220181886750859,4535162500649787448,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,3645506129961734105,3636544031344214088,524288 --field-trial-handle=2264,i,14849220181886750859,4535162500649787448,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:8
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4552,i,8758977424582891351,9256301387601885035,524288 --field-trial-handle=2264,i,14849220181886750859,4535162500649787448,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:8
  2⤵
  PID:5192
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4552,i,8758977424582891351,9256301387601885035,524288 --field-trial-handle=2264,i,14849220181886750859,4535162500649787448,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:8
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4952,i,11710826412344051079,2751998331420357076,2097152 --field-trial-handle=2264,i,14849220181886750859,4535162500649787448,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=4956,i,2144971081163642159,11524800243824160962,2097152 --field-trial-handle=2264,i,14849220181886750859,4535162500649787448,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,2048365062635074423,15118090732033293482,524288 --field-trial-handle=2264,i,14849220181886750859,4535162500649787448,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:6136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,18024485762743450029,3810964762805330334,524288 --field-trial-handle=2264,i,14849220181886750859,4535162500649787448,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  PID:5140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5928,i,7158429043847309777,4401495585845237983,2097152 --field-trial-handle=2264,i,14849220181886750859,4535162500649787448,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:5780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  PID:4680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffb8bf1c188,0x7ffb8bf1c194,0x7ffb8bf1c1a0
    3⤵
    PID:5652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,284558120606619954,17204648622763272194,524288 --field-trial-handle=1404,i,14458992645217947586,7668083199233049862,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,7586059592173579065,5397120567319239471,262144 --field-trial-handle=1404,i,14458992645217947586,7668083199233049862,262144 --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:2
    3⤵
    PID:4404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2444,i,8122408955934632181,5566470760143849090,524288 --field-trial-handle=1404,i,14458992645217947586,7668083199233049862,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:8
    3⤵
    PID:2232
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,2462498682669529475,7110319355587741230,524288 --field-trial-handle=1404,i,14458992645217947586,7668083199233049862,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:8
    3⤵
    PID:3972
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,2462498682669529475,7110319355587741230,524288 --field-trial-handle=1404,i,14458992645217947586,7668083199233049862,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:8
    3⤵
    PID:5848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4908,i,9885113856310526190,5845883363091645921,2097152 --field-trial-handle=1404,i,14458992645217947586,7668083199233049862,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:1
    3⤵
    PID:4740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=4912,i,1472348988430677852,4718284085203864301,2097152 --field-trial-handle=1404,i,14458992645217947586,7668083199233049862,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:1
    3⤵
    PID:1044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,421224826349976478,3819456754149556116,524288 --field-trial-handle=1404,i,14458992645217947586,7668083199233049862,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:8
    3⤵
    PID:5528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,3385589544842941558,10761201632350129723,524288 --field-trial-handle=1404,i,14458992645217947586,7668083199233049862,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:8
    3⤵
    PID:5680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5904,i,17320498532319682364,1656965027965528260,2097152 --field-trial-handle=1404,i,14458992645217947586,7668083199233049862,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:1
    3⤵
    PID:5352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:4252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7ffb8bf1c188,0x7ffb8bf1c194,0x7ffb8bf1c1a0
      4⤵
      PID:1852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,16456641360302816498,16387609536453026727,524288 --field-trial-handle=2288,i,2340800593871534847,5653488820376580947,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:3
      4⤵
      System Time Discovery
      PID:5448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1744,i,5996483665850518469,8972864549274295351,262144 --field-trial-handle=2288,i,2340800593871534847,5653488820376580947,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
      4⤵
      PID:3772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2604,i,8418576690249524836,2733061716364247541,524288 --field-trial-handle=2288,i,2340800593871534847,5653488820376580947,262144 --variations-seed-version --mojo-platform-channel-handle=2880 /prefetch:8
      4⤵
      PID:1772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,2489220029793110929,15026464421025561952,524288 --field-trial-handle=2288,i,2340800593871534847,5653488820376580947,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:8
      4⤵
      PID:1240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,2489220029793110929,15026464421025561952,524288 --field-trial-handle=2288,i,2340800593871534847,5653488820376580947,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:8
      4⤵
      PID:2104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4940,i,4091891959443995904,4677745836916450983,2097152 --field-trial-handle=2288,i,2340800593871534847,5653488820376580947,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:1
      4⤵
      PID:5904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=4944,i,5584906528623283613,11541394799735593947,2097152 --field-trial-handle=2288,i,2340800593871534847,5653488820376580947,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:1
      4⤵
      PID:5248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,9079110388103898668,804984073033351937,524288 --field-trial-handle=2288,i,2340800593871534847,5653488820376580947,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:8
      4⤵
      PID:5144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,2083125253746718746,9685467942861800014,524288 --field-trial-handle=2288,i,2340800593871534847,5653488820376580947,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:8
      4⤵
      PID:560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5916,i,10054674632752452444,10118130244218070467,2097152 --field-trial-handle=2288,i,2340800593871534847,5653488820376580947,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:1
      4⤵
      PID:6060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      PID:5940
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffb8bf1c188,0x7ffb8bf1c194,0x7ffb8bf1c1a0
        5⤵
        
        PID:5532
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,12019989774997518232,6602898783070035024,524288 --field-trial-handle=2124,i,17832201183908758535,14520849176745361721,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:4736
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,11617649735673366129,132622879168066472,262144 --field-trial-handle=2124,i,17832201183908758535,14520849176745361721,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:2
        5⤵
        
        PID:4316
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2588,i,11265911473147934478,3933262114457237166,524288 --field-trial-handle=2124,i,17832201183908758535,14520849176745361721,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:8
        5⤵
        
        PID:4756
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4532,i,9953456344715960390,5478658749114473872,524288 --field-trial-handle=2124,i,17832201183908758535,14520849176745361721,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:8
        5⤵
        
        PID:4324
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4532,i,9953456344715960390,5478658749114473872,524288 --field-trial-handle=2124,i,17832201183908758535,14520849176745361721,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:8
        5⤵
        
        PID:6112
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4976,i,10173863664440234073,722477341984692975,2097152 --field-trial-handle=2124,i,17832201183908758535,14520849176745361721,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:1
        5⤵
        
        PID:5912
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=4980,i,16707692410906956890,14769584906459474278,2097152 --field-trial-handle=2124,i,17832201183908758535,14520849176745361721,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:1
        5⤵
        
        PID:3796
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,974564098675745111,12099376738626741469,524288 --field-trial-handle=2124,i,17832201183908758535,14520849176745361721,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:8
        5⤵
        
        PID:5872
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,11185570517202911897,17775550144133698656,524288 --field-trial-handle=2124,i,17832201183908758535,14520849176745361721,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:8
        5⤵
        
        PID:5944
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5940,i,4276582739181878409,17725313089971658942,2097152 --field-trial-handle=2124,i,17832201183908758535,14520849176745361721,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:1
        5⤵
        
        PID:5900
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,5679502153048596421,6920139616494533935,524288 --field-trial-handle=2124,i,17832201183908758535,14520849176745361721,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:8
        5⤵
        
        PID:3972
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6124,i,3323269408425175134,14236091296238230166,2097152 --field-trial-handle=2124,i,17832201183908758535,14520849176745361721,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:1
        5⤵
        
        PID:5832
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,965428213129995839,12033527934550595778,524288 --field-trial-handle=2124,i,17832201183908758535,14520849176745361721,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:8
        5⤵
        
        PID:4484
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3808,i,11471494966095812190,5682005402385292421,524288 --field-trial-handle=2124,i,17832201183908758535,14520849176745361721,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:8
        5⤵
        
        PID:5276
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4372,i,8157989003708143061,6481708322732682913,524288 --field-trial-handle=2124,i,17832201183908758535,14520849176745361721,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:8
        5⤵
        
        PID:5812

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5020

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:932

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3032

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
TLSH
T178F21D566E241E3CCA9EC336340836C34D78023DACF3B762A58A719747AD181E37D6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
TLSH
T1C94379DF2A348110CA0768BABD71771BB655D0BFC1C2F0A87AD68A1780B463CE775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 cd6d3f8f0a2f1468a6661c3787d8f8a55cef994e004606c64d72eaa71dc815db
MD5 f6a3f6e1d1befed3ef56d0cfa100f51c
SHA1 f0e3dcc5ec08014d6e9e996b603d0473ee9999b6
SHA512 05e056b5d02ad96df051704dc7561c103f762758e5d69e9f04705d4ec8382b41aaa56afa8aececd941fea8be5d1d733720698dee6e32c50a9d75ebc4981ee837
SSDEEP 384:yeYdThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:z+eUZsLQCZsL3hUS4
TLSH
T15453CBDB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0c4a0495-966e-4e78-9933-15fc79b4bcc1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0c4a0495-966e-4e78-9933-15fc79b4bcc1.tmp
Size 23KB
SHA256 be5e761a4e7b2dbeeaf096670bde1d16e22f3c58374fd08f897acafd75a61df8
MD5 1f5f6f902044531516e18a58689a52b4
SHA1 809420cf401173f6d78bc3de47cba15abfe64b4d
SHA512 eee44a43d41d41bebc80339f4a976c8e6136d85f6e0870ff58953c3f82f7298db66315ca302820cfbd9fda77901a777025ee76fe453d5e1c840a8e2f96569216
SSDEEP 384:nEZcIbsNTp0w3bZDufR+MOjTVv0OYSh6jCwJrZBGC3YASnLoi979PJAxJVChYQIo:ibADHniOYBjphZQC/SUi979PkJVCb
TLSH
T1C3B25BB0E8646DF389A6D9C6A586FA077FE80137D2851A4CD0F8BE3D305F6B81313865
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

156d21e4-985e-4e4a-8477-a9b00922b3ec.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\156d21e4-985e-4e4a-8477-a9b00922b3ec.tmp
Size 23KB
SHA256 2d29e7b87832bab85b6094742668def7b5ad33782f1bc52d2ee401c5356b4d14
MD5 f88fe20ab616891b3c511b3507661180
SHA1 259b711b61d6190e4eaa2d8641d84532811e4912
SHA512 54d48e32ff1fceaaa8a822bcbcb05c9e4bb784a1901b8e517dd666bfe206f93fe22368e50958a2d96afda6f017cb793998d77c6ccbeb9f00f9982f1600c6f7e1
SSDEEP 384:ngZcI6sNb60w3bZDuSbRyMOjTVv0OYSh6jCwJrZBfqOASnLoi977PJAxJVChYQIo:e6H4HniOYBjphZdCSUi977PkJVCb
TLSH
T19CB25CB0E8646DF389A6D9C5A586FA077FE8013BD2851A4CD0F8BE3D305F6B81353865
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

44e3f195-28e2-43d2-acdb-9ab935b4cb01.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\44e3f195-28e2-43d2-acdb-9ab935b4cb01.tmp
Size 23KB
SHA256 79ad07edba5175523666dc60edd9a8f50ffd493d8c22f8e254e915d4d8ff6779
MD5 a983443df4d348faf7bf677c87c0212b
SHA1 e472ad3f86b1e0edf3a2d130ae7c056ca83299b2
SHA512 4520837985f09d98715f00d3eff3abe1944cbb86dced045b59dbc9b01c363d7398e388b0f06f0786b480b0a3fa356ba38e6df84da118cae890936394d2afa617
SSDEEP 384:nOZcIC3sNYQ0w3bZDuctRJMOjTVv0OYSh6jCwJrZB/uYASlLoi97HPJAxJVChYQT:sC3kl1HniOYBjphZpMSei97HPkJVCb
TLSH
T1F8B25CB1E8606DF398A6D0C5A586F5037EF84137D6892A4C90F8BA3D305FAB81317869
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7892fd9d-3378-4806-b3a5-74c4d4f82f53.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7892fd9d-3378-4806-b3a5-74c4d4f82f53.tmp
Size 19KB
SHA256 5b700598d34ddb09554c355840369bf41ea1308d1bb29002582d42ea0f0b1191
MD5 2ca24b255abf3f0e275f96fae56badcc
SHA1 ac2ba0c39b80e879ecf72b641d42658f97b5b4ed
SHA512 2ce0fed67393f8dbb92965f0a1fd244b7b064d8fcdfe1917794e0364a81e47af4fd01785ea64ad1055c40299ed56fb6fc2d655a8d0be452e6dcefc7ba7c35614
SSDEEP 384:n6ZcI6sNbz0w3bZDuaeIMOjTVv0OYSh6jCwJrZB4+PJAxJVChYQIU/7Iz0:46GrHniOYBjphZG+PkJVCb
TLSH
T1B7927EB07C64BD7259A79106F6CA3A43AFF85177E6C51F98E0F89F1D108279D230B829
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9b0732a3-84c3-4456-a0c4-ce9b6e87bc17.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9b0732a3-84c3-4456-a0c4-ce9b6e87bc17.tmp
Size 8KB
SHA256 c538d46559014f9d88e2095a4de7d5bc5f58159d72eebf83db09ef3d7243b653
MD5 60c7003ddcd89e7d15df916ae222b00f
SHA1 227c6c0940230e2b1962970bb31d08d63f9caad5
SHA512 6cae26ea9ce65b15ab61e8b258810ad8d86f46d5acfdaaa110a7da43dbeae56e70a31bcaf725acd23c826e2fa539a06ced5b812f724d7f0c57717fd6f4735c8b
SSDEEP 192:SONx6ygpQmiUya3tOCTVgI0OXoSPzPlFU6:SONx6lHjtOCTVv0OYSbHU6
TLSH
T1E702C734BC687CBB8EA76E45F88B26139F98117BDA552B84D6E81E1C01D779C2306836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 452a5479b9a2e03612576c30d30e6f51f51274cd30ef576ea1e71d20c657376f
MD5 cfab81b800edabacbf6cb61aa78d5258
SHA1 2730d4da1be7238d701dc84eb708a064b8d1cf27
SHA512 ec188b0ee4d3daabc26799b34ee471bee988bdd7ceb011ed7df3d4cf26f98932bbbb4b70dc2b7fd4df9a3981b3ce22f4b5be4a0db97514d526e521575efb2ec6
SSDEEP 12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T14F724986B34494EFC883597189BD17903374F6EE5F02839B6A267A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 88ace5b30dea7756d572973832a0d5dd05025984b6533d195fee0a3c16428fcc
MD5 d722c9299941ab0f44ac49f050f6e31d
SHA1 b158755b85272c7a2922f3c4984dba65b8ac0553
SHA512 9b5b3c15f392d957c4bdfbfad691c80fa64aec5e3f9bdb3832ef91071a80d5032d0e05001d9198419a78f972e17b3c307548982ad003989eb8a505a3b911048a
TLSH
T1C3D080F8D9721514CD4D50B5133B67401362D130114715BD51EA650C557075061469FC
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7bb1b9accba28e2f52ee8cf94b2e38c261d05389ede48f0b5c5e02fafe297358
MD5 41b0b413f697e28eeb064e50efa627bc
SHA1 138fd6d3cd62d40ab678ca43edc95377b5a3e46f
SHA512 17cf35df9f13afcba53f4ab38167ba10f33639ace961b0b6f7a9e11628f77a7958a0e2ac566a1ba70aa031cdd4d7e65f00a70877b94400ae70c3eb625b62378f
TLSH
T1EED08CFCEA622624CE8E50B5233A6B801372D230614B16BD50EA250CA970790628BAFC
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c904cde2439d0f658b6928376273908e18874923ffb5ab0253d91ef97d247274
MD5 71592819d06ab9dfd94505cef3db0b85
SHA1 fa4c610ce7419e5f934db322abc11ec563259b9b
SHA512 f0dccb656458e10495c6728811a1fad970a69f8abb5ce8e9bcba9e93f496cd66fb3ce8ce1065b946203d7912789774c609787e85dd5139479b2562b6f05cfae0
TLSH
T16BD002F8BB950515C5C970F7713BDB8143B6EB218246265D64F21E082D747B23606895
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 23cf39ebeafaf6d9bc469ace7cec99612d591f1345ee1497e688dc9e4c6ce8c3
MD5 bdf5eba72e8ff30b5b78b2c2da90edeb
SHA1 eb6dd943761950c298a5df45401e75a13f116043
SHA512 3f57c5e111930be02fda8b2d7decd4e6c480e789cba635379c5048b7950a5054cc51acfaeda1825b92e9861e2ddaaf71e9633808e52eb3686bca5c0a432bdb0b
TLSH
T1FBD080F8D9621514CD4D50B5133A67501362D130114715BD50EA150C557075062469FC
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2104799fd39240a75d82607d7063b6a030ec057341531053ff4b6e563fbe0cfe
MD5 c4e34a1a675832767dad3ad1aa10cd86
SHA1 93f22b1b7714ec3844e86f36781663422d131901
SHA512 1beae827d8045c0b7713176dded8a8d5d12f12348be48a276efc679422adb425ee7289e25dc0baa03b8d327d6966a5f36f0182c01e1d59f7ffa34d5e5536fcde
TLSH
T186D080F8D9621524CD4D50B5133A67401372D130114B16BD50EE150C59707547146AFC
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 261bce3b7c1900b3a47e18d9eee301d3545eda71a7710e48db4c0048aee10f72
MD5 8f270d6772ad3173f0d3e2e69c2b7b15
SHA1 5d36e736dc58451e52411e024f61dacda23a3427
SHA512 2bc9245bf5b21eea8f0606603387f2fef42d9d05968da59dc78747bc5f7cc8a6328d8ad5e5d842870a268ac52ec72059438fe70ddfa2c85d1fcbf6b55eb4af8f
TLSH
T112D080F4993147E0C59C107911345540537587325246179911D61C085D702915557DE4
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7dedc9d49eb246f22b60ef3100947e149dafe521bd8fad7fffbaed54f4e5ed33
MD5 c4d179558eede1eaf965e93484b9e286
SHA1 3fbad97afa3c0f579a4d2f543f72fc7c1c153c98
SHA512 3d4960d104c19af718d269218a91bea27dd44b64782725a37be9c0f2044654840711353104b3b131df2021959fa615c5b94051bd14756cd29f53959b7cb3d28f
TLSH
T12AD08CF8EA622624CE8E50B5233B6B801362D230214B16BD50EA250CA970790628AAFC
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6282ccf35c71b65df8a2e29b20c9cd4536ca0f64937f17a840bb0921675c809e
MD5 76c10700be28910cfba9e07177f19b45
SHA1 9dc750c7e48bd6a009804b1bab9537e5da8e1bf5
SHA512 777638957a4fa558cd96e9d05341268649fe30a9898697bd5392005be9026b55c93da5403a9ac3d6552e747e9b42876ab9025d77947193505e9f661cf398fd3d
TLSH
T1FCD080F8DD625514CD4D50B5573A67401362D130114715BD50EE150C557075061869FC
MD5 SHA1 SHA512 TLSH

Submit Download

036a9f53-6b46-4e30-9623-ac6e1c0c464f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\036a9f53-6b46-4e30-9623-ac6e1c0c464f.tmp
Size 32KB
SHA256 397f3d6646212188df4edd6f44327b88ed46d60ed3d0441a8cf39f3f5d83c2e1
MD5 e17fb71f33160560df136bc8fce6d34e
SHA1 d58fdb0409cadb74beb2490de72fc58dc48a7c93
SHA512 79a7a8d442827514589a49b4027ae387276e277695763023841f65bd2e62342dbde85b12b7b809cbaa092ea8b735d0365b407c3906ec2c3d822e088210a0aae6
SSDEEP 768:a0K9umQ7pLuLjwYWvcQWs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVNe0HLlh7k35rop:a0K9umcEjwYWvcQWsu1jaMe0HL7Q3ywM
TLSH
T188E2FA7F780CCB7E4FC00A9DDC5A7F9A7EA8029B9698895047FA941C02C66EE51160DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

03939f46-a933-4ba1-8c47-2e2ceb151d06.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\03939f46-a933-4ba1-8c47-2e2ceb151d06.tmp
Size 13KB
SHA256 f500052eb1834451eea46752c15da0e53f852cfb4d4ac7d71c5efc599d78a127
MD5 1b4452bf0ab3d0467f4e17b070de7ee3
SHA1 ac4674d148da9bf4708291161b8fd65e27161238
SHA512 697afe86af0eba85f3cd27dd5cf1110a04e7cc78faa6b51535681b80209a741720911ff685e74af69e97c354b98b482a487a70f8b5444d77f2d0f93457eb3a32
SSDEEP 192:sxZpwR0j3/fEs2WpVo1ORk/L6zodpnwHW6+WNNsNrrbYRvg9xIeWgIgyJ:sxZ+e3/fEs2WvoX/NwHbYrbmmiehO
TLSH
T1A552D816AD24A97B8CC7D21DFA557F53E7FA002264825E48AAFC891C05F7ADE320741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0781d598-d2df-44ac-8b6f-9f69aa613de8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0781d598-d2df-44ac-8b6f-9f69aa613de8.tmp
Size 414B
SHA256 44858d601da13b8a6b804897a9178a7005ebcd37954dff6dca913456bfee8e6d
MD5 dccb7186912af587d1ea943815c0d194
SHA1 a5e777c3bf14a3102385168b4a39c775eb386dab
SHA512 5799496b9647fb5968c86cec4d0fc98e75a2e7e54fa25afde7066bf20172a562c3d043f45561150ce51c6631da2a98314a6bdac2f90faa83e733a5cdf7bed245
TLSH
T1F3E022AAC826EC3709FA172850924B02FB90539B2A42D94F3A3DA1088FB472A018685C
MD5 SHA1 SHA512 TLSH

Submit Download

25e8222f-6994-4c05-a243-5fabc6318904.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\25e8222f-6994-4c05-a243-5fabc6318904.tmp
Size 13KB
SHA256 15a790236bcb46feb3c2b76e02fd6be6ebf5f6363a67967afca558e76fa87d9d
MD5 b0698c11ce0685f984ad6f075155c1c2
SHA1 0409060b01fe2f52b6807059d2d44404ef9f56ad
SHA512 7a034f07292d275d0cca13c9f6a3340ea1061b1776b75774ffc801979eed77ad4a265f52901a1c5c62515b56b2f5370a00761b251d1ff9578313dac83ee85f22
SSDEEP 192:sxZpwR2j3/fEsYWpVo1ORk/LZzodpnzHW6+WNWy4ZZYRvVfIeogIgyJ:sxZ+43/fEsYWvoX/WzHboZmCeDO
TLSH
T1D952D815AD24A97B8CC7D21DFA557F13E7FA002264825E48AAFC892C05F76DE630781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

376601e2-8668-455c-b2f4-aeb506c3b37d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\376601e2-8668-455c-b2f4-aeb506c3b37d.tmp
Size 12KB
SHA256 6f9218f3fc404b18ddbd5724b5a0cab0106a598d3b980d87bdd1693cf3074a86
MD5 f575d9e78087b97399a6ef19a4c28c30
SHA1 ce5ff0cce3ee8f6ac00426ad7af7af5f88cd25d1
SHA512 59c958259373494bc770f3164789a014ec15c415981f52525c7227f6dc190c8ddb031214fa295e6567931c5d7301890fa92ff4e31fb634c4786c07dd48f3caf7
SSDEEP 192:sxZpwRej3/fEspWpVo1ORk/LxnzodpnCHW6+WN5L4AxXfYRvQ0IUqIgyJ:sxZ+Y3/fEspWvoX/FsCHb3fmy5O
TLSH
T17D42E911AE34A93B8CC7D21DFA557F13E7FA002265925E48AAFC8A1C05E76DD630781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3afc96e9-f7ee-4393-b73b-3756f7bafae1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3afc96e9-f7ee-4393-b73b-3756f7bafae1.tmp
Size 12KB
SHA256 538a2bbba5d9a790d63726c529073fca4e7d85e393d0574a6036182d68dbf252
MD5 931eda4c7c22984bb3ca74885e0d1795
SHA1 4059c03c061aa915cce0a36c6e6ae732594956ab
SHA512 f0e99c13a3a85d64613dc39e2cb339fa5ca88e519cb9644d20a88896dd12377fa286690a6085639f4627fec6c5c81a974b35942eb699fbf96928a143eb18a145
SSDEEP 192:sxZpwRej3/fEsaWpVo1ORk/LxnzodpnCHW6+WN5L4AxXfYRvQ0IMgIgyJ:sxZ+Y3/fEsaWvoX/FsCHb3fmyfO
TLSH
T12A42E911AE34A97B8CC7D21DFA557F13E7FA002265911E48AAFC8A1C05EB6DD630781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5fd77322-c1c7-404f-b83b-63b433bbfc78.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5fd77322-c1c7-404f-b83b-63b433bbfc78.tmp
Size 11KB
SHA256 488da7256be7c5f6fd57917fcc2a988409677e00e25d026c675cb1f7e74135cb
MD5 1c7e84f17e22cbbc6bffbc5ff09e2ebd
SHA1 26835e2273e568824fc3e1e600dc7ab9d73c23d0
SHA512 00e259a0dfb29e1668e80a73feee09648a65d6e50889dc7febc15a347d229eca1dc05afcf6814d797b5d10e0797e9f304283a9347b6ca2212bb7196819b6de0d
SSDEEP 192:sxZpwRJZ3/fEsvxWpVT1ORknIdpnKHW6+WNRI3P/YRvmIIggIgyJ:sxZ+h3/fEsJWvTXoKHbu/mS7O
TLSH
T1BB42C752AD34A97B8CC7D21DBB657F13E6FA0022A5921E48AAFC851C04F67DD630781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6832a423-dbe4-4074-8963-045ad033f29a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6832a423-dbe4-4074-8963-045ad033f29a.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

6da6b21a-7ad5-464f-ab66-ba8f443453a4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6da6b21a-7ad5-464f-ab66-ba8f443453a4.tmp
Size 13KB
SHA256 3c1ec505f71a4985150cb7882406d1ceff53ddfd7e8af9b5bd028a7748194224
MD5 5b1e01e4349480daa12618e27b2e38c4
SHA1 54acb89ed4cd046f5b24bf5f4070469b86562302
SHA512 3b3804486f0c5fa6fb16c629cc790c7fa24b2e7f7b47e13e6a21487526f3be6baae3add0d81f87dab125ddfb2b92bb44efda41190c0a4768410c19cca7be532d
SSDEEP 192:sxZpwR2j3/fEs2WpVo1ORk/LZzodpnzHW6+WNWy4ZZYRvVfIeBqIgyJ:sxZ+43/fEs2WvoX/WzHboZmCewO
TLSH
T13B52D815A924A97B8CC7D21DFA557F13E7FA002264825E48AAFC892C05E76DE220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9cfb63e7-18cd-4f1c-b7c9-3299245a07e2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9cfb63e7-18cd-4f1c-b7c9-3299245a07e2.tmp
Size 12KB
SHA256 b605f82d8675476c4c86a177a1a0a4354951cc46872abcf9c11ba6baab416cdf
MD5 389b62d56060b70afb156bfeeeb30a43
SHA1 66d41192d0848c082a0eaaf934952bf885583318
SHA512 d6983b2dc21726674bb55e6a5b0f905553cfc3a2a402149189f4ce16b538f96b7f92dc4b0057d6bdcf92254048e2103922924fbf3eef88727bbbc1d945426676
SSDEEP 192:sxZpwRdj3/fEsTWpVo1ORk/LCzodpnsHW6+WNRaaOZYRvHPI9gIgyJ:sxZ+33/fEsTWvoX/1sHbkZmoyO
TLSH
T17952E715A934A97B8CC7D21DFA557F13E7FA002265825E48AAFC8A1C05F76DE230741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 17209407cbb2564c7f04726cc8c8f0aead4d0e75c3bd4c886604514c8618f495
MD5 1f504413a36009b0be249e37835c68bc
SHA1 9b348b6d3f6b0a17ba384bb459e08e05f34b9302
SHA512 8c4ac81030c6cc33ffac4710bacb8e8174b002cc803f3ee1bb0adf5c84080f75f57fb26f72838da50e5431eea8ee4daaa4c966c2c858ce10a60e0e631e030b98
SSDEEP 3072:lW3ivHQ58tyry6vy5W8fouoyQM2yM6EWiDv2BOGfQD:K2tyW6vy5B5QM2yubDuBOGfQ
TLSH
T18C2539EEC7682C42DF6B8770B0E0D9077E712082B69DD0D39944C5E997D2B8576E82BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 2986d7e41035b38d19d389ecb370df0eed7468a5d7e9878d2779a25df123c922
MD5 81a06a97940f75780bc98613da7ce8cc
SHA1 a49f60b170310a11d1ef8c756bfe9d58e953eff4
SHA512 af3dced7623e47cdd70db55fbddb07646dc21b511a49a01bf291743cdbaf6fdeee14dca92bf53f71b4627568fa026f929767187bbf022d55ae98a432ac890784
TLSH
T1E151C5DB8A904CF8F7A88C7181ECA2633A7C4CB259832D72CC9DC17D8B0A3DE904D014
MD5 SHA1 SHA512 TLSH

Submit Download

fc3c9348-dbed-489a-8773-880da8844d6b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\fc3c9348-dbed-489a-8773-880da8844d6b.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 570B
SHA256 99def1b557f19f04c1affc6f247d0451f33fc10ec42e73792223c3215ac98be6
MD5 d4ba0ae0bb0b9faff3da6f35fdbc3c8a
SHA1 fb3e9dec7f35a9b1d94e54a5659dd0de484055e7
SHA512 86fd07c34b9abd4c52ba19eae291936f92bc6d38a75c021edc1dedbc15617669876180cd99f959c62476d82ec6bb9f5fe4c6cb4d82cb037efb76d99a4d3d9c51
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 c09078811aecf4e7e3df2d6a3c6b0faa1c7725ecba79637c542c8bc9b2772fb3
MD5 b3a2fa103c2fcc632c0fa5d090cac03e
SHA1 2906f691174b0d51bb7efab8d5945abd81ed1860
SHA512 d3bbdd99655a9025a2567e768ec31ff4208e32f1d8613c433eddd6cf5739c5a18d63d3fbafddd6b6fb3d658270825394dc9fc0ac15d8b16459785ca2d6915dcc
TLSH
T1D9E0200846C9C119D16878AB0268670897E03857B3C03E5B5F8DDC54724E389E27B140
MD5 SHA1 SHA512 TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 5baf3eec8a91ec77053b542719ef32885223a30770092c0dad6352dbf4e50f70
MD5 9c7b1b119e66c5be030583538c655111
SHA1 334ae6176e81e9d2c1639e4ba597ff9b3ab63ee6
SHA512 f1456ef793be3ded85e3c34cfa057f59dd747b50acfb07319da37c901528d7ea58bc1c1f3ef3a0efa132ae77a2d75839988a7826398421b3aec789fbbc713136
SSDEEP 96:eAWPckIU+bGz83uy3+u4tgp4DLjGQLBze9z3wAljBHMsDEuspU0wbtqrOQpPfR4K:xpkf+G83uy3Ct7XBBKfXH7DXspU3iD
TLSH
T1AA14225E5F242322CDBD517669E744A35D6DF03F8B5376DA686104B0CEE2A42A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 5152e3545cf032dbb73b44b4f0de391ae415444c877343b94316c8fa92aa92c5
MD5 eba1b507bb0164723e0b62a100517050
SHA1 5f1e471e7a50df18f13937889373c645f3b2f562
SHA512 bd2bf3e146358a778db77f915d433d92887956fe77f230d92b970914da67c9644eaf7e8ca04660e34255343fdf91210feca885f6e4655c1e8f6914123f4d648f
TLSH
T1C3E0D86846EEC119A209709B02256B09D7A02856D6C43F062F4DE955B10F184B6921C5
MD5 SHA1 SHA512 TLSH

Submit Download

0d5fbc87-11d7-41d6-92ce-a5ea0280b29f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0d5fbc87-11d7-41d6-92ce-a5ea0280b29f.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

51d6de6f-6f5b-4ec8-a69f-3e5a80f72794.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\51d6de6f-6f5b-4ec8-a69f-3e5a80f72794.tmp
Size 3KB
SHA256 b7a10134d02a7ca9d50f017d9a3fae88e301857b818eb65cebbbb0f28743643c
MD5 44488d45bde2b8e6c295407683c315c3
SHA1 5a4a0cab6212b94f497827148c6e7351f0fcb9b0
SHA512 f97312350195ddd56253e6151f060ce2712af6e4b373ae15b6f5dbaa8a99905c97ed45b95aecc51bb2fa2ba0dc38a14effabcd32f853e6bc19ce278611b0dbf2
TLSH
T13661BFF7C2E4861DC9015AF0A724BE1BCE2D0A18532C3D5AC8D5EF5B97E2470E14169F
MD5 SHA1 SHA512 TLSH

Submit Download

63d1ffac-e5b4-48f0-9a3a-c6fa64913601.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\63d1ffac-e5b4-48f0-9a3a-c6fa64913601.tmp
Size 2KB
SHA256 8b3970e4bc1ed716b7b831964ee20bb08a48d4bd7d8d51cc8006afafefd3056d
MD5 c2d7e2e703da1bdf2b0a1edaea48ba13
SHA1 097f05ffc65511e3c058de1c1678d6e0ffedfef0
SHA512 4bfbc4bbb442193eb367e466860d003da395bf10c3f382cb3a9b56e9b3fd46e1e19e449bf8ca7f49cd6966e3c848032e024d44a23f4a03fdbe7e6145f9f02708
TLSH
T15D51CFF7C2E8862DC9025AF0A7147E1BCE2D0A28532D3D5AC8D5AF5B93F2470E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 fd53e46fef3a7ebc31b14007ceb7b37f5d42c0050e547067f113f429ca8bcb3a
MD5 a888663693b8eb59403a44f6d729b302
SHA1 f9e379726e397ed0146047e303edbc7796911d1b
SHA512 d7f03907de4816a72f522b5f7392aadaeb5c65dc55e8c4f9f5b551bd611dec2216053e1f447089e5f9dd26e36010cf8c90c9651962a9f89c0dfbdedd2dd65175
SSDEEP 48:TtLopFMatSaw/auUOt8BY+o/wUdhtvBzAwH:9eMatUaAKo/hddAA
TLSH
T134921F4E6F306211D0B05B76EED089672F7C102D83B37699DE1430F2CD9265FF6068AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

cb1128b2-1186-4608-aacd-70f8cecdf2ac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\cb1128b2-1186-4608-aacd-70f8cecdf2ac.tmp
Size 3KB
SHA256 5bef820833f4f4034d6aa3cf78e76b0101c2db0ce51fd54a901866872149090e
MD5 10c7177d6f4908430f427abd4c5e526b
SHA1 4b7f774f9cc2822180c8ea0646456fe8593c7c45
SHA512 260a72ce1958f9fbfc827cc9338dfe1ad652ec135542dfaa2fc48dd6e2f4199de7940a226eb325e4a57245955471e8cd71d24d41a3b3e6786bed698b2647dd5c
TLSH
T15E51CEF7C2E8862DC9015AF0A714AE1BCE2D0A18532D3D5AC8D5EF5B97F2470E14169F
MD5 SHA1 SHA512 TLSH

Submit Download

ee501198-2c7b-45ce-89e7-5dc68ce5293b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ee501198-2c7b-45ce-89e7-5dc68ce5293b.tmp
Size 3KB
SHA256 14ed93e68b96fd299494e84c18b23f7ff4245e3fd31559beaf923102d106356b
MD5 5b5bcdd36f280cdc4a9f384012490d6d
SHA1 b7750d463d7d670560e4bd1c1dca51f1897ba808
SHA512 1e278ec8c9268eb337f57193f3c4e60993221fc8aeb2c0c4d0c59b9b5d97a551d29ce87cdd27c0ab97745fc4c619dbfebbaddab2ecd54e9aa7eec20c18e570bc
TLSH
T1ED51D0F7C2E9861DC9015AF0A714AE1BCE2D0A18532C3D5AC8D5EF5B97F2470E14169F
MD5 SHA1 SHA512 TLSH

Submit Download

f9db6d8f-37e9-4728-aedc-43a6c7ea7631.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f9db6d8f-37e9-4728-aedc-43a6c7ea7631.tmp
Size 3KB
SHA256 4744e22122192e9c74b78e4b633866fa1f1bb1120cf74a5bafe4c5b5dcbe8682
MD5 ab18031b025fd96990e1c43da60e2577
SHA1 4799e449aa44782ce89e5e1e5f6dec12e247116e
SHA512 bba9aeb2f17f1cf09b3d762303159c1700490f731e0d186358915659d531f9c897c1436ac9a34d59ff3d21cf4ceadf0cf0914f6ba6bc3bafd6db52f16be8e1a5
TLSH
T17961AEF7C2E8861DC9015AF0A724BE1BCE2D0A18532C3D5E88D5AF5B97E2470E14269F
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 9abc2d20ac5e7cf52f7fd343a919fe37ecbb0fa08029274dec9b71e637d49865
MD5 2ebe6fba4b970205c3f9214a2889c66a
SHA1 673f193f7449509b0b306243fa3e8cd043a2a81a
SHA512 54ada81d092329fc811d3312e4ba642876448623dbbe768c2c6a520e9e95498d523cd7102b23b186913dbcdc357c30c0017454795100b079ad50a70f2824f27e
TLSH
T1BDE026140AEAE17DA16930D702B4830A83E47867D2C43F0B3FCDDA66724FAC4B1E3180
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log
Size 725B
SHA256 2e80397e6fa09cb1698fa388a7320553c5d6a4395a4511719c2413cb80f89120
MD5 c92bd10701fdfd78741a98512e6c4847
SHA1 84b1b6140320416f889d990f524c5ee3c2951559
SHA512 4a906883d380739f367471e6335b2a3729061e9b1d4e02305e6d56c2872c724496027375276738b14ad676b82046c2cde97a6ef880c95f81a7b2daa58abe202d
TLSH
T1780176EB2E05489ACD6987B154C87B38D7B381DC07C6CAC796AC424D5A111322CADC2B
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG
Size 319B
SHA256 db23f0f88f986cbe8c95b05956d954d8c91701c1148fd92b053871d217c451f1
MD5 9b71b07c61e20ab3987009fe39a76ea4
SHA1 e5d2c458af615fc9e42de117e6210d1ff96986f0
SHA512 0697013596211ce41263bb7323421a57811a8c5fefd57ac3c6299edc99f149eaeb57800dfaa8f32617f7aefc2ac9553661dfb2a8841f9eb7da4f399e527a3630
TLSH
T1C7E0266806CAC16A921874AF0238530D83E13866E3E43F07378ED468734F2C1B7A3281
MD5 SHA1 SHA512 TLSH

Submit Download

Tabs_13436423303446531

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13436423303446531
Size 1KB
SHA256 a1c02a8974f17fa26ad2ea84e041a2e6b905b034624c1a4b6c893dac0729fffe
MD5 8dcd00b7451e2d054808ffa273f4bc3a
SHA1 f536b2ce49f4433848bcf3a4fbd899a85437291a
SHA512 8a462d8948ca31d137786b3fa6e56aa2a5387be7aad202fd3f294639bde6522d749e66bf75d60a2fa10df043e46ea59e6cacec1ee2b56e0c42e54cd79292b75d
TLSH
T14D2102051BD84119F376063640AF11E5AA32BD013E958D0952A1F11458B4A15FFA1F9A
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 8a98913cc888c5776c2c8ad9823b3c7ec9a4ff8ce6be1238b59cd1718b5a733c
MD5 e4be551b6432643c493cb4ab7c7198e5
SHA1 d6d297992c3d81717a727c2fa20333bcd777f20f
SHA512 4f66bff5fefcc6666a8dfcf031ac6eb65d2b31a7b343c09509fad3d6aaa976933036125419d41182685247a857b712a1126e76d047cff8e5ea6f73d168f19ce3
TLSH
T1F2B092187B00A305D4CA47306A5987406210F44200A55A53B8598F120E06AA42E0ADA4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 6f3e6fd32264815717aa87a63bb5e460d61901f9f93a20a1c5d04f933744339b
MD5 8b168b318ede2a9d6fac24d614dda633
SHA1 2768ee5aca878216b357970ebbe47d6195bc9e04
SHA512 70c1b4800eea4d7a5159d494e72ee03727ab2a7e4563880355d3c0cbe067ee3398d118099abf27d247671065ce963e9d69bc680d02b890ebf62dec9c2e8cf885
TLSH
T1F5E0487427CAD22AA34930DB0264D348C7A2795BD7D83B272B4DE694730F3847253541
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 c70e2c533abf9e296574cb4aeb707a4d85ced0a5536cca1c6aedceef609d5bf7
MD5 1b56e24ae656e68675e733533e042131
SHA1 420c4d11db82826cfefeaacc0ca327a994c0907f
SHA512 c331615146b339f3f55d4d670bd92bde1ec682d4e68bf13b705b2d7612b3ea3bd29ee4f6c5c011627456adb0f95664c9e74a5fab9ebc38415e02461be4e76325
TLSH
T19EE0867457CAE239D18970DB0264AB4E97F07C5697D43B9B5B4CD464B20E284F2B7580
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b05d32ad816632d31bf5b03bd208a16a92f6e65024e9834482f3ce158a6dc0d5
MD5 aec8658c44dc5609352d5c5a3751f5cc
SHA1 fae1554b6a88f0041e44b7ed66ec7101d3b03c69
SHA512 ba6592b72ba6e1897e945d0c9c7c6762ea6abde4f013597d346d119e2182f2134245ae28f88619d05376b6a3cf8312161ff4ee06f8bdf4a4d054dcc24a919595
SSDEEP 48:K0mImIXOS4iGHbeFeISqHK9G18HxQXYtOWMyLq1YEqo4pb0TkIS8pK9g1apxS5Y4:K0md/uK0sqOt2KGQpHaKsgI
TLSH
T11791EE0132BB120139FE755881A48B2A924131B33159F52BBBBC50754EEFE584CFF9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 d778e803d422f420269b4d76192eb8e67cc40e2cab881c8a6630f4f8cb123bfa
MD5 f9c70dadcc006b7b4d46dd603145618f
SHA1 98257757e9d521a37b87b5de299192dc58328db9
SHA512 f5cb0accbacb398f714863fdb382d02cba186337240abd3cc3e1077673025b8756b07184cbf94189e722ee179989237f890664d22c5e531bac7c84d5d2839b88
SSDEEP 192:/+5W2YcfT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:W5BfQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T13424630A7B747001EDE6D9725CB080771E3CB16ECF22A6915DA254698DB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a234d222-cbb1-410c-a1ca-1bb035d4dcdf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a234d222-cbb1-410c-a1ca-1bb035d4dcdf.tmp
Size 13KB
SHA256 a103e934d79589d76ea7814e14790ff22ae653ce4b78883a24d070d8ad5013ce
MD5 fa76e8eb411e767e6087ef74d1f092d7
SHA1 401e1a323796078fb07ea24d25a0e3be0ed66f1d
SHA512 806d792fad4ba4cb0429589be4c072bbaef72d373b19877fc1bd5902a35ff0ad75b52d43892fb2435a7f78af9f15a1f6cf21bf72cea705b51a08249e05d4b899
SSDEEP 192:sxZpwR0j3/fEsbWpVo1ORk/L1zodpnNHW6+WNNsO2pYRvoAxIenqIgyJ:sxZ+e3/fEsbWvoX/aNHb2pmbieqO
TLSH
T13852E815AD24A97B8CC7D21DFA557F53E7FA002264825E48AAFC892C05F7BDD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ab9dbf95-3606-47c9-9b51-07132cc99ff8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ab9dbf95-3606-47c9-9b51-07132cc99ff8.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e2c6129b-0708-4aeb-8a57-d06e475d3024.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e2c6129b-0708-4aeb-8a57-d06e475d3024.tmp
Size 12KB
SHA256 7a758d4cf81aebf052ff9cae603ca65779061dde2d05def0ede89b67a4e45c48
MD5 9f3394e4954e71c74e8655fb123f782c
SHA1 2292c8b33ac33f8cd094ce878bd3361c5bb82c30
SHA512 d2cb914ae431c9b6a03d43170774dc5cc94233caeb7e6f4e0a37f5cc06f1f9fae91f18495902b58b15873ea35ed3e43f3bf04d0c4d1729a72136a03a6d5d5735
SSDEEP 192:sxZpwRej3/fEsTWpVo1ORk/Lx6zodpnsHW6+WN5L4AaOZYRvkiIUqIgyJ:sxZ+Y3/fEsTWvoX/FBsHbtZmk5O
TLSH
T15942E815AE34A93B8CC7D21DFA557F13E7FA002265921E48AAFC8A1C05EB6DD630741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f948b692-10e3-4348-b15c-8ad0607e7b99.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f948b692-10e3-4348-b15c-8ad0607e7b99.tmp
Size 13KB
SHA256 db3c4a3f1b32f52b45791626274cead0937f35f28590ca2d30e869381b398c41
MD5 27f2dc383564698c657f81a05374dade
SHA1 6ca99de56091f24be55972f8a06ce084ded2e275
SHA512 c34b484677e508d2d901bea6341537971d769b9ee0b6ba433a0b5d7cf7d7654040e8569a2fed63a9b136966500100c218f8bdb487b790f091b7ca5c383af00d4
SSDEEP 192:sxZpwR0m3/fEsbWpVo1ORk/L1zodpnNHW6+WNNsO2pYRvoAxIenqIgbyJ:sxZ+/3/fEsbWvoX/aNHb2pmbieqC
TLSH
T18E52E715AD24A97B8CC7D21DFA557F53E7FA002260825E48AAFC8A2C05F77DD220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

load_statistics.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
Size 80KB
SHA256 1c0a01946c37790d808418bfb4e4ea686b3e69bad3489a6adf8a9777c7359b75
MD5 07d4f64abd1e945fc85b98d2dc74f12a
SHA1 0a8b9a5ea9061c94a75cab13b2e1b7ed66f08a7c
SHA512 5e64f1370929c06e99252437b5fbd492db0a3751d16a78ab41cad507feba98cbd5fb104a898974d3ff4038bef36f2f0120215a32d3aa50ec80a3d794c40ff858
SSDEEP 768:L8woLOABF1nm7xGTd9yxHgE/9FPmpeZgUzsZDKREpSq0Jygv1o+2ab0Njk:LY/TXp9J5yx
TLSH
T16983EBF7AC49A1AEC9CD95789C0BFF8454330662C624D8E4AE7C08C33B7AA073D75685
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

load_statistics.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
Size 80KB
SHA256 8d0af15c85158a81cb2491009bf1cdd404d01804f0b8e868f7f09cb3d48b6c50
MD5 d35d66e206eeffea94b87da473b75e32
SHA1 b7270e2e6683f51bdab5968f1f2231fa236bad07
SHA512 12c3b7258b101cab8c94783898f3b8d7439fe6b277101c090d63594b0635e85416e20d284a8b370e42d69f9ed4c8aa79ec7e502b9f27c35095c87c284e75f61d
SSDEEP 768:AD+CeoLOABF1nm7xGTd9yxHgE/9FPtheZgUzYDKREpSq0Jygv1o+2ab0Ljk:AD+M/TUh9DyD
TLSH
T1ED83EAF7AC49A1AEC9CD95789C0BFF8454730662C624D8E4AE7C08C33B7AA073D75685
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 90c33d37954aea3fb1c64335dc92af96f7bf6ee6c132c336dc4a920e6019a5b7
MD5 14430bc538038b4fb9cf4cfe8041680b
SHA1 34abcfd4f041fe4da1c9be618bccdd536680c7a8
SHA512 d4c49b18eed297c1be523d5518142e7699c54c9d28cb9206f8e3273ca2e0e635471f936f928905c57fd4bc2bc2e75b9270848a4a44942de063573ea8df2fb41d
SSDEEP 192:j95QkIIIbbLMIMNsYcYlNOL7AsplrQ5Q2s2kS4yV/:j95QkIIIbbLMIM2B5L0srz2s2kSJ1
TLSH
T1B452952A27051B73C04EDF7A139B87791BD988819172252D3163980F8DF3E97C6D92F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 c7fdf4bd9a491fd69a1009fbb60423567c274f2d0dc2537a432f55164cf03bb7
MD5 43805a6d1eebc16ec285495cac2a95d1
SHA1 809123956327e08a98bc2c5766b4e27b3554d5d0
SHA512 81bb91419c465bb33d418e765c05653655618e4ada27d944183c6af3a58e6e1597f4347ad754fec6960b430b60e46cf4117766a83f779d45a6fa88c0dee8dccc
SSDEEP 192:j95QkIIIbbLMIMNsYcYlNOL7AsplrQ5Q2s2kS4yV:j95QkIIIbbLMIM2B5L0srz2s2kSJ
TLSH
T1FB42942A23051B77C08EDF7A139B87791AD888819172652D3153AC0F8DF3E97C6DA2F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 6e30965686b56105ee0963177084e8af75babf0b129b829c7978a5aeda3ae555
MD5 f23f2134719d49255abfa49a4102b391
SHA1 cbf5ec2a05f76caebfcb0a88269dc2f9cb9aff6f
SHA512 a61fb518833cd498c27e04015b7f4c2d6466814fd869d05582e197f05933116cde7bba939253c22c6dcd22c907efa193b4dafd9a09980a6b9cac765c17cc2b80
TLSH
T178E0201467C5C15EE13870DB0174534987802D57EED43B0F6F45C558710E6C07697141
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 ca1eaac7af9173e08ca5f11165bd71986652b66a932543311c05971e0d1f28b2
MD5 63cd85f19c6e7bca56e91d77e10b9f21
SHA1 8bb76db2ca3429c3724269c4a1e026d2270da315
SHA512 ad3cdaaba50a73092e3be60d4b5d1b81616190f2654a24bc31aa39c7a9b0ab8ce49e839828f5edbe3b94d75b72bddb5ab7fb46811400f0f69a860f11d670c40b
TLSH
T1232168A5F330C14AC1498A7A643A6B251338E4018FF8EC0F147620B43F72F041E8B2EA
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 4bc3232a48e0d9bc01225b45b5063a80e6b1ac4cc98fc014939e6f1036a61823
MD5 78b59efd1b39af845d18f1e2a5e2d806
SHA1 a22e1c6d5f55bf97fe33f57c7ace2d127e9d8f0f
SHA512 12c8176ef187ef003eb65db37b0dbc4e8cbe64d14084649d2e7b5054c76a46c4c0b19dd8d9f5fbfbc5a5d19b2230fca7f842c38a0f539461b3b0f5d7a38e8d2f
TLSH
T158E0201866C5C15FD134B0D701B4974987913CD3EAD03F0F6F45CD58720E6C17657141
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 1d62cbcc3db8057af219d4fb64187d6a78e8d774a1da1816af20f22a7414202d
MD5 033b7725252c054fe235260e55ca51ff
SHA1 bbb31453fd80509a6dde181e9ef20fa79f26f29f
SHA512 d50393d19cb054add2e12fc9afef78e5684f14dced8d421f090036f9a24a130841ca40cb548751461dc16bf846ff8d86b53fa9d7ec89181c99db4192819d33e7
SSDEEP 384:ntZcIqsNLUo0w3bZDuFR/MOjTVv0OYSh6jCwJrZBgRRAStiI7oi975PJAxJVChYt:1qEIHniOYBjphZSIS8i975PkJVCa
TLSH
T1E7A25DB1D8646DF389A6D1C5A486F5036FB84137E6892A4C91F87E3C30AF6FC1316869
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 85B
SHA256 b26da4f8c7e283aa74386da0229d66af14a37986b8ca828e054fc932f68dd557
MD5 bc6142469cd7dadf107be9ad87ea4753
SHA1 72a9aa05003fab742b0e4dc4c5d9eda6b9f7565c
SHA512 47d1a67a16f5dc6d50556c5296e65918f0a2fcad0e8cee5795b100fe8cd89eaf5e1fd67691e8a57af3677883a5d8f104723b1901d11845b286474c8ac56f6182
TLSH
T1F2A0120384738407E4144051C45C1341287C84570119C0012068931304240CB039643A
MD5 SHA1 SHA512 TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

a6457023-45e9-4c2a-a1e1-25bc2b366af7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a6457023-45e9-4c2a-a1e1-25bc2b366af7.tmp
Size 19KB
SHA256 dcdaca42f03e36acabd1935343a552990437c4278303191ddccd65a3dc204a8b
MD5 001f571798b29be7aaaca96344795f72
SHA1 4c8fe9d3b6d8ad7d76979f7755cd98a637157602
SHA512 d44d8e62e2b68b63df2a7f0ee1a06af96740a5c9dc1f005d3de2b8ab8164ebb2743db38f73e21517d2b7e0d555cb7386c87434fdd823f41e9137da5743b82583
SSDEEP 384:n6ZcINsNbz0w3bZDuYeIMOjTVv0OYSh6jCwJrZB4+PJAxJVChYQIU/7Iz0:4NGpHniOYBjphZG+PkJVCb
TLSH
T139927EB07C64BD7259A79106F68A3B43AFF85177E6C51F98E0F89F1D108279D230B829
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c91f21a5-f6fe-4650-b370-782232bfacd0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c91f21a5-f6fe-4650-b370-782232bfacd0.tmp
Size 22KB
SHA256 aeb94991812f32f7bce5f1eda92bf8474ef60e358680886e42c378aa90b2ebf8
MD5 fd5afd2657228eb202e541e9b0a5199b
SHA1 514fde3919e228985d7d53fd63d3338832783613
SHA512 c85f3933308b30d7126da5b69dd98dd0cdee4285d20450ca67de29b5152d670a20947a7946dd18fa6d7b5ffd9b8b6a3441cf5b31101b7af5b7b8a52f66d2407d
SSDEEP 384:ntZcIqsNLUo0w3bZDuF2/MOjTVv0OYSh6jCwJrZBgRRAStiI7oi975PJAxJVChYt:1qENHniOYBjphZSIS8i975PkJVCa
TLSH
T1A0A26DB1D8606DF349A6D1C5A486F5036FB84137E6892A4CD1F87A3C30AF6FC1316869
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dfb62922-847f-4c81-a40d-8956ff5d0643.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\dfb62922-847f-4c81-a40d-8956ff5d0643.tmp
Size 19KB
SHA256 25e066bb51bb33cc6a6c3ea249a47e0e80e6e7bccd962a01affd9ef068ae9777
MD5 58ac2ddc4104351a39bb316c6fde9211
SHA1 a8ffa24fba890fdf600e63f15580660dd21c6644
SHA512 8cf4f649d4d36078fb5d3b90b1b935aa8ee966a558613272258c2942a66c5c9419d2dce8680565f44492ddee92e1a2cef6a197e0a6004790efc42b2a32f98e42
SSDEEP 384:n6ZcIbsNb60w3bZDuSbeLMOjTVv0OYSh6jCwJrZBfICxjPJAxJVChYQIU/7Iz0:4bH+HniOYBjphZdICxjPkJVCb
TLSH
T1CB927EB06C64BD7259E79106F6CA3A43AFF85177E5C11F84E0F89F1D108279D230B829
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ec3821c1-eadd-41d8-9371-b6ea288b8882.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ec3821c1-eadd-41d8-9371-b6ea288b8882.tmp
Size 8KB
SHA256 39ed455b3ad3e271c3203d24ce6d70afa1484be8bdba8dde1f73ea9d8eb7c0ff
MD5 eca5378f0420f27d60fcd726d4ac5b84
SHA1 43c0f7683a6ac055ea8f8a53d771acde0524ac9a
SHA512 3ba2566a6629d8784190ba125fe8a79fddaefd6ad9dea455ef37fbe0aa130d4506a22e2c8a758b2ac5aefdfc43c541ce6336b853cd2c7ba6d5ab24dec4c109c6
SSDEEP 192:kONR6y3QmiUyF83cOCTVgI0OXoSh6j+FJSJrZBnz3UzqMIU6:kONR6e+0cOCTVv0OYSh6jCwJrZBwUU6
TLSH
T1A512F874A868AC735DA7A145F4CB3693AEA810B7DD466F84E1E85E1C00D779C370BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

762f3c3c-51ef-418d-85c8-23d28d347b1c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\762f3c3c-51ef-418d-85c8-23d28d347b1c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f8959fd3-5d15-43bd-9ff2-bdc0a26b0953.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f8959fd3-5d15-43bd-9ff2-bdc0a26b0953.tmp
Size 23KB
SHA256 29127924335e711f4e5eef2f218acab516bbed326707e70ea3ffe67377b74d26
MD5 1a85df95f193fb971672ab15838fc942
SHA1 d9d31108cdc85d873c0789bc2e75f09904889bee
SHA512 37d643da89392a1a98c6729e33a037872b4d7d032271d47481e434d2cdf61b2966422cb57fd5b178a11b462c2233667ccfc2e491b91c528140fff7820678e478
SSDEEP 384:nuZcIEsNSa0w3bZDu2RuMOjTVv0OYSh6jCwJrZBmr3YASlLoi97CPJAxJVChYQIo:MEGqHniOYBjphZsr/Sei97CPkJVCb
TLSH
T175B25BB0E8646DF348A6E1C6A586F6037EF81177D6851A4CD0F8BE3D305F6B81317869
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5c4a65fdc8067585161f5e4a4bdf482cfc58b24991f94b53d0040aeb2804faba
MD5 b08339142c0e0602e164af99db24386c
SHA1 bf7c4b131c5ba2733ba77d51efbc69ecd55b7c60
SHA512 215fe3aa813dd7dfc1b29e07ab68e1720c2f37134db43bcf01f0e8aca632654442be12add00d0e9673f26c5147e788e120c53269bf4393013b1e074105a9536e
TLSH
T1CF413B5CAAEA1148B3B36E566FF7686D48BBB9772E06C45D10010E0E0627F40CC71B37
MD5 SHA1 SHA512 TLSH

Submit Download

284e4050-59b1-4fcd-8ee1-dcd10944d4ae.tmp

Path C:\Users\Admin\AppData\Local\Temp\284e4050-59b1-4fcd-8ee1-dcd10944d4ae.tmp
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3c219f83-c214-48d6-9843-bb5869a819c4.tmp

Path C:\Users\Admin\AppData\Local\Temp\3c219f83-c214-48d6-9843-bb5869a819c4.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3360_1951328951\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3360_793779033\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c12ba1c9-aada-4260-b923-85ff3fe7ddad.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3360_793779033\c12ba1c9-aada-4260-b923-85ff3fe7ddad.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4808-98-0x000000000D560000-0x000000000DC52000-memory.dmp

Download