494b78ef602a84661d87182ecd0cc58dc6fb1398e92c585cc23b1c137ad8b694

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/10/2026, 18:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Aubrey_Consultants_New_Project_at_Riverstone_Grand.pdf
Size 23KB
Sample261022-wyhgfset4x
SHA256 494b78ef602a84661d87182ecd0cc58dc6fb1398e92c585cc23b1c137ad8b694
MD5 9b80d32d2d91944d6a7f5dddf2b86ff3
SHA1 911a374c07148dc9837495da48f39ab698dc4b69
SHA512 bef55c46c42df584bbf1bcd2941fed45c33aad2bf9533dc24e1ffe31f825a049247571feb12ffbac9d706fe53f6abc8d92b37b1d969667f100707ac90b2ce8ad
SSDEEP 384:TO2f2lZai8rLvd7xRtGg6PCiswwVemkTL7CUSu3YplKPAeGmckr68twc5sUTu/Bm:pelZZGd7MgK+YmMZYGxrOc5sUTUa
TLSH
T164B29D7EE8591C4DE8E7C742D123385D0A3DB1178ADDD9D270728B627C44A80BA736AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_980336927\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_980336927\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_980336927\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_980336927\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_980336927\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_980336927\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_980336927\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_980336927\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_980336927\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5344_761761722\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_980336927\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_980336927\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_980336927\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_980336927\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_980336927\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_980336927\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_980336927\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_980336927\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_980336927\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_980336927\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_980336927\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_980336927\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_2564_1891221199\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_111_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_980336927\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_980336927\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_980336927\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_980336927\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_980336927\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_980336927\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_980336927\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_980336927\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_980336927\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_980336927\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_980336927\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_980336927\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_980336927\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_980336927\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_980336927\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_980336927\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_980336927\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_980336927\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_980336927\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_980336927\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_980336927\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_980336927\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_980336927\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_980336927\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_980336927\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_980336927\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_980336927\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_980336927\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_980336927\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_980336927\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_980336927\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_980336927\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_980336927\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_980336927\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_980336927\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_980336927\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_980336927\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_980336927\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_980336927\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_980336927\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_980336927\_locales\en_CA\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5116	msedge.exe
3952	msedge.exe
3536	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2714045687-1127350534-2056456672-1000\{BB230246-3298-4310-9C17-29F43C2E19E6}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2714045687-1127350534-2056456672-1000\{085FD5A5-D050-4B4D-B728-725D83137C4A}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2714045687-1127350534-2056456672-1000\{611EC215-C7E8-483E-98BB-4BACEDC9AADE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4816	AcroRd32.exe
4816	AcroRd32.exe
4816	AcroRd32.exe
4816	AcroRd32.exe
4816	AcroRd32.exe
4816	AcroRd32.exe
4816	AcroRd32.exe
4816	AcroRd32.exe
4816	AcroRd32.exe
4816	AcroRd32.exe
4816	AcroRd32.exe
4816	AcroRd32.exe
4816	AcroRd32.exe
4816	AcroRd32.exe
4816	AcroRd32.exe
4816	AcroRd32.exe
5344	msedge.exe
5344	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
3136	msedge.exe
3136	msedge.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
4816	AcroRd32.exe
2564	msedge.exe
2564	msedge.exe
3136	msedge.exe
3136	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4816	AcroRd32.exe
4816	AcroRd32.exe
4816	AcroRd32.exe
4816	AcroRd32.exe
4816	AcroRd32.exe
4816	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 2960	4816	AcroRd32.exe	90
PID 2960 wrote to memory of 2880	2960	RdrCEF.exe	91
PID 2960 wrote to memory of 1684	2960	RdrCEF.exe	92
PID 2960 wrote to memory of 1684	2960	RdrCEF.exe	92
PID 2960 wrote to memory of 1248	2960	RdrCEF.exe	94
PID 2960 wrote to memory of 1248	2960	RdrCEF.exe	94
PID 2960 wrote to memory of 4536	2960	RdrCEF.exe	95
PID 2960 wrote to memory of 6128	2960	RdrCEF.exe	99
PID 2960 wrote to memory of 3052	2960	RdrCEF.exe	101
PID 4816 wrote to memory of 2564	4816	AcroRd32.exe	103
PID 2564 wrote to memory of 5768	2564	msedge.exe	104
PID 2564 wrote to memory of 3536	2564	msedge.exe	105
PID 2564 wrote to memory of 4928	2564	msedge.exe	106
PID 2564 wrote to memory of 4928	2564	msedge.exe	106
PID 2564 wrote to memory of 4928	2564	msedge.exe	106
PID 2564 wrote to memory of 2656	2564	msedge.exe	107
PID 2564 wrote to memory of 2656	2564	msedge.exe	107
PID 2564 wrote to memory of 2864	2564	msedge.exe	110
PID 2564 wrote to memory of 4684	2564	msedge.exe	109
PID 2564 wrote to memory of 2864	2564	msedge.exe	110
PID 2564 wrote to memory of 2864	2564	msedge.exe	110
PID 2564 wrote to memory of 4684	2564	msedge.exe	109
PID 2564 wrote to memory of 4684	2564	msedge.exe	109
PID 2564 wrote to memory of 5292	2564	msedge.exe	111
PID 2564 wrote to memory of 5292	2564	msedge.exe	111
PID 2564 wrote to memory of 5292	2564	msedge.exe	111
PID 2564 wrote to memory of 3040	2564	msedge.exe	112
PID 2564 wrote to memory of 3040	2564	msedge.exe	112
PID 2564 wrote to memory of 3040	2564	msedge.exe	112
PID 2564 wrote to memory of 1828	2564	msedge.exe	113
PID 2564 wrote to memory of 1828	2564	msedge.exe	113
PID 2564 wrote to memory of 5528	2564	msedge.exe	116
PID 2564 wrote to memory of 3144	2564	msedge.exe	115
PID 2564 wrote to memory of 5528	2564	msedge.exe	116
PID 2564 wrote to memory of 3144	2564	msedge.exe	115
PID 2564 wrote to memory of 1632	2564	msedge.exe	118
PID 2564 wrote to memory of 2100	2564	msedge.exe	119
PID 2564 wrote to memory of 2100	2564	msedge.exe	119
PID 2564 wrote to memory of 4388	2564	msedge.exe	120
PID 2564 wrote to memory of 4388	2564	msedge.exe	120
PID 2564 wrote to memory of 4616	2564	msedge.exe	123
PID 2564 wrote to memory of 4616	2564	msedge.exe	123
PID 2564 wrote to memory of 960	2564	msedge.exe	124
PID 2564 wrote to memory of 960	2564	msedge.exe	124
PID 2564 wrote to memory of 3136	2564	msedge.exe	126
PID 3136 wrote to memory of 4616	3136	msedge.exe	127
PID 3136 wrote to memory of 2428	3136	msedge.exe	128
PID 3136 wrote to memory of 5116	3136	msedge.exe	129
PID 3136 wrote to memory of 2428	3136	msedge.exe	128
PID 3136 wrote to memory of 2428	3136	msedge.exe	128
PID 3136 wrote to memory of 3924	3136	msedge.exe	131
PID 3136 wrote to memory of 3924	3136	msedge.exe	131
PID 3136 wrote to memory of 1096	3136	msedge.exe	133
PID 4816 wrote to memory of 2368	4816	AcroRd32.exe	134
PID 3136 wrote to memory of 2352	3136	msedge.exe	135
PID 3136 wrote to memory of 1076	3136	msedge.exe	136
PID 3136 wrote to memory of 1076	3136	msedge.exe	136
PID 3136 wrote to memory of 1076	3136	msedge.exe	136
PID 3136 wrote to memory of 2352	3136	msedge.exe	135
PID 3136 wrote to memory of 2352	3136	msedge.exe	135
PID 3136 wrote to memory of 4236	3136	msedge.exe	137
PID 3136 wrote to memory of 4236	3136	msedge.exe	137
PID 3136 wrote to memory of 4780	3136	msedge.exe	138
PID 3136 wrote to memory of 4780	3136	msedge.exe	138

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Aubrey_Consultants_New_Project_at_Riverstone_Grand.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2960
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2CC03F4B32D564EAFFE1FB38A87089D4 --mojo-platform-channel-handle=1804 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2880
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=62B51A3BBB0D0CB74ED521E4702ADB24 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=62B51A3BBB0D0CB74ED521E4702ADB24 --renderer-client-id=2 --mojo-platform-channel-handle=1808 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1684
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=607E198CF1DAB99989DA35C519A9B5AC --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=607E198CF1DAB99989DA35C519A9B5AC --renderer-client-id=4 --mojo-platform-channel-handle=2384 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1248
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=8AE1C652F020DF8362864A888E2E9406 --mojo-platform-channel-handle=2740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4536
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=43D3C8E2D77E66D3C2A462B5959D2676 --mojo-platform-channel-handle=1800 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6128
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=4BCF502CAC23C6697C70C4B9B92431BB --mojo-platform-channel-handle=2832 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aubreysconsultants.com/Aubrey-Consultants-New-Project-at-RiverstoneGrand
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x354,0x7ff87bbac188,0x7ff87bbac194,0x7ff87bbac1a0
    3⤵
    PID:5768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,11929956908282728207,5777392189415886805,524288 --field-trial-handle=2572,i,12583227343867232004,7022906064192267445,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,7045941913893811635,980465825687496961,262144 --field-trial-handle=2572,i,12583227343867232004,7022906064192267445,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:2
    3⤵
    PID:4928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2172,i,13099886507230821782,9608581208818001238,524288 --field-trial-handle=2572,i,12583227343867232004,7022906064192267445,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:13
    3⤵
    PID:2656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,18167984361161673974,11224790683915599219,2097152 --field-trial-handle=2572,i,12583227343867232004,7022906064192267445,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
    3⤵
    PID:4684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3540,i,8947786112594017950,16554117081699473604,2097152 --field-trial-handle=2572,i,12583227343867232004,7022906064192267445,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
    3⤵
    PID:2864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,1826311257929135406,8448406034647787385,2097152 --field-trial-handle=2572,i,12583227343867232004,7022906064192267445,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:1
    3⤵
    PID:5292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,2135628832757297598,5126605519064114764,2097152 --field-trial-handle=2572,i,12583227343867232004,7022906064192267445,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:9
    3⤵
    PID:3040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,15211069878103338138,6906811309887905066,524288 --field-trial-handle=2572,i,12583227343867232004,7022906064192267445,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:14
    3⤵
    PID:1828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,12282758814185364737,15243991082800232774,524288 --field-trial-handle=2572,i,12583227343867232004,7022906064192267445,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
    3⤵
    PID:3144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,3779730182575499114,10683355923747530021,524288 --field-trial-handle=2572,i,12583227343867232004,7022906064192267445,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
    3⤵
    PID:5528
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,8390527013948195874,8101709010036223047,524288 --field-trial-handle=2572,i,12583227343867232004,7022906064192267445,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:14
    3⤵
    PID:3136
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,8390527013948195874,8101709010036223047,524288 --field-trial-handle=2572,i,12583227343867232004,7022906064192267445,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:14
    3⤵
    PID:1632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,9252755157568841054,5627620680131527388,524288 --field-trial-handle=2572,i,12583227343867232004,7022906064192267445,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
    3⤵
    PID:2100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,15282216598782058696,12089985389688147309,524288 --field-trial-handle=2572,i,12583227343867232004,7022906064192267445,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:14
    3⤵
    PID:4388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,17577479806961968447,233368200408427704,524288 --field-trial-handle=2572,i,12583227343867232004,7022906064192267445,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:14
    3⤵
    PID:4616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6808,i,2551894313623747857,1694115114238520771,524288 --field-trial-handle=2572,i,12583227343867232004,7022906064192267445,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:14
    3⤵
    PID:960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7ff87bbac188,0x7ff87bbac194,0x7ff87bbac1a0
      4⤵
      PID:4616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,4972943971944797632,13924884410115393794,262144 --field-trial-handle=2284,i,13880439100986895130,7871223747058220620,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
      4⤵
      PID:2428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,9989909858012097974,9673471987136103549,524288 --field-trial-handle=2284,i,13880439100986895130,7871223747058220620,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:11
      4⤵
      System Time Discovery
      PID:5116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2496,i,16643118782476102731,10380415891233261153,524288 --field-trial-handle=2284,i,13880439100986895130,7871223747058220620,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:13
      4⤵
      PID:3924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4448,i,6642591398163163330,18248450655845554220,524288 --field-trial-handle=2284,i,13880439100986895130,7871223747058220620,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:14
      4⤵
      PID:5228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4448,i,6642591398163163330,18248450655845554220,524288 --field-trial-handle=2284,i,13880439100986895130,7871223747058220620,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:14
      4⤵
      PID:1096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5116,i,13029311244773802866,8724353297650306468,2097152 --field-trial-handle=2284,i,13880439100986895130,7871223747058220620,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:1
      4⤵
      PID:2352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=5128,i,17105194848511666355,3378079013576885930,2097152 --field-trial-handle=2284,i,13880439100986895130,7871223747058220620,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:1
      4⤵
      PID:1076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,13967169692114884220,10011160312386615233,524288 --field-trial-handle=2284,i,13880439100986895130,7871223747058220620,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:14
      4⤵
      PID:4236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,15089837850977724936,1541895349363492124,524288 --field-trial-handle=2284,i,13880439100986895130,7871223747058220620,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:14
      4⤵
      PID:4780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      PID:5344
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2e0,0x7ff87bbac188,0x7ff87bbac194,0x7ff87bbac1a0
        5⤵
        
        PID:2612
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,1917820419958786343,6901398292006675728,262144 --field-trial-handle=2228,i,18099163646187299193,7102219800377554498,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:2
        5⤵
        
        PID:3472
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,8553252115411923417,6649466478295759894,524288 --field-trial-handle=2228,i,18099163646187299193,7102219800377554498,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:3952
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,5650133154978769920,3648937827558000835,524288 --field-trial-handle=2228,i,18099163646187299193,7102219800377554498,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:13
        5⤵
        
        PID:3784
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4400,i,1318460933206847160,984592871067000284,524288 --field-trial-handle=2228,i,18099163646187299193,7102219800377554498,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:14
        5⤵
        
        PID:3036
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4400,i,1318460933206847160,984592871067000284,524288 --field-trial-handle=2228,i,18099163646187299193,7102219800377554498,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:14
        5⤵
        
        PID:1068
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4832,i,16152482779762007498,286918955460733602,524288 --field-trial-handle=2228,i,18099163646187299193,7102219800377554498,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:14
        5⤵
        
        PID:1076
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,16839752319307286777,16712658946313965376,524288 --field-trial-handle=2228,i,18099163646187299193,7102219800377554498,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:14
        5⤵
        
        PID:4864
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4692,i,12706024583940917219,10460868816325769615,524288 --field-trial-handle=2228,i,18099163646187299193,7102219800377554498,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:14
        5⤵
        
        PID:460
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,13346505234317736921,8490578797325265238,524288 --field-trial-handle=2228,i,18099163646187299193,7102219800377554498,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:14
        5⤵
        
        PID:4508
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,18175213975622805151,40305044343822737,524288 --field-trial-handle=2228,i,18099163646187299193,7102219800377554498,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:14
        5⤵
        
        PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aubreysconsultants.com/Aubrey-Consultants-New-Project-at-RiverstoneGrand
  2⤵
  PID:2368

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2652

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5112

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1260

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 7d89194616353b1e7866dddcbbf79fde953deccc7b84e102c1577e16d77ca30b
MD5 44f4cca7af79967765e90dbdaa7a2d84
SHA1 d5b10e0c31ea482da5397973f65e0c97999e5641
SHA512 c9a265dace3c54a25b1ca1a44f96bcc456f932d7a3699d959b3e17802b1afe21087d53de8e2fae4edded2151c34f28a9619682e9610523149267d52b207a10c6
SSDEEP 384:ieSdThatELJ8SWvDTRGftZsLglKhubvGZsLRZh+vS4:B+eEZsLQCZsL3hUS4
TLSH
T1EC53BBDB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 d71d1305c79a2034db8e37ace1a0b6340010ed2f20baf47b5c4bbf019a7d4cf8
MD5 a696652c2db0ff42c331e385e1c780bf
SHA1 9ca1d2a3e17a4f3b366cbb913d274955f806c338
SHA512 fb1bc57c46be522c21831b9bdc7f2bac3e46e3b961970c84697b9bbcd3e5899b77f9d8de720fce6deb3535bc55247bfa1c9b59fba7ad9adb68c9fab6b30c2831
SSDEEP 384:yeRdThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:o+eUZsLQCZsL3hUS4
TLSH
T16F53CBDB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
TLSH
T178F21D566E241E3CCA9EC336340836C34D78023DACF3B762A58A719747AD181E37D6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
TLSH
T1C94379DF2A348110CA0768BABD71771BB655D0BFC1C2F0A87AD68A1780B463CE775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SharedDataEvents

Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents
Size 12KB
SHA256 3d0de88c0d9832179730b965053d70fb4974cae78386797139160168d41d61d9
MD5 48541cc7f123d7d9ef25ea842029a5fa
SHA1 cdffda18fa4fb14a60b732b3dcc19aadc4bf6356
SHA512 4305e0087537d610f9d3a5fda4d25e53258bd6c8b9f3470f9bbf738c1b4623146245de2507c6bb69f0bd167cf09d5ce326a43b2ea71bb553224a998e8a0d9391
SSDEEP 24:TLTGx/XYKQvGJF7ursSObRFDitB86SZQL6Ut6:Tul2GL7msSObHDir8/g8
TLSH
T12342ABAE497B2372C8BC443AD1C20076273C208EE7B350C15AE095E593ABB05F0071C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SharedDataEvents

Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents
Size 12KB
SHA256 e49cc7b503c7c9ded45c35ffb0d0dfea08a0d71f9fd79df2d48d1b6d671b2f2c
MD5 ddc3ea5e2e3ff801c9d9ad4cd82ce4b7
SHA1 19816af8f884235565271d13b550934890c3b314
SHA512 60ac476df8a1af3b06128859624e220c1b34d79b12af71b62e98f71ac1093d457edda5b422f3c12943720b51249f60a307b09b94ca1129e8080c11e72991406a
SSDEEP 24:TLSx/XYKQvGJF7urs2FqRFDwRFDitB86SZQL6Ut6:T+l2GL7ms2FqHDwHDir8/g8
TLSH
T1584259BE867B6772CCBC447AD1D20076273C209ED7A390C599E085E693EB705F5075C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

14addab0-363a-48c9-8a37-77f1e3a4927e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\14addab0-363a-48c9-8a37-77f1e3a4927e.tmp
Size 34KB
SHA256 692ecbbf54896d9f40a1644b3e9f6f0594fa85b0648258bddec3456365078d70
MD5 0408d48deedc7a7a1ac777799e645b28
SHA1 2f879bc379a1ddf1b95046941ec796a52fdf63ce
SHA512 3066c16978735009e9a8f80d6ebe099e548c237d13fb88a4d1ede752d7b59190f2075cb395af0ab2895cdc554c5f0722292e143dc367d2ea0a23a668342f30bb
SSDEEP 384:nOQkUSvA38NlkwB+Ct+199fw7DJPzdvLcN9YkWwJJhoMSboCzfnFLj/ITKewQTMw:+A3KNQKnJPxDc9bsMSJz/Fn/cKeczNLu
TLSH
T1F5F2CFB5AC619DA7DDE7A6807A9F36977FF40643C8C91E84D9CD6E1C028329C234B427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1d0c0650-4306-445c-b216-df94beb7d5f4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1d0c0650-4306-445c-b216-df94beb7d5f4.tmp
Size 37KB
SHA256 9a8ab2a0f50fb1e0c5f994c5dd26532fcdd648efda46fc1d8a873867fa6dbd87
MD5 1db6feb0f1d2ae8a493ea70b1c04a116
SHA1 cad59dc25022029b0baa7cadcccb8ead3176e672
SHA512 7f7e6f4ad01bbaa416b3db866a2d91abdb63e336299b44a565a0306c1205ad7e2a4c56dd4015aa4c6b0dc73051b3db8199927de45df75d46f8e8d0fe42069dfc
SSDEEP 768:z/UxvxjgC+U3C9KnJAxDc9bsMSJz/FnneSHXPyK/:GZj3+U3h2VQbs7JToSb/
TLSH
T13F03D03AEC505CA7CCF7A7803A8AA647AFF94953D5C52A9849DD6E0D07C73AC1307827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

27c3d9db-ac57-417c-8e0d-6313a9beaf62.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\27c3d9db-ac57-417c-8e0d-6313a9beaf62.tmp
Size 37KB
SHA256 4065a18d3b0db374e42fdf76d5b386636e83f7209bcb467eafddbe186112c2a2
MD5 54510d7b8f6951c44188ee0414e12214
SHA1 eb576f60c90b28a021cd974c2660f6c4124ecd40
SHA512 5bdde307dc974e297053063a9174f90dec714312d86341d131b17b6559184fe32bcef41c884784ade4c9787aafa7a034e6b204388ad5d49ee3698e3e21bf09c2
SSDEEP 768:fszgQP5nJTxDc9bsMSJz/Fn9eXKgtkA1czkL9k:fszNJVQbs7JTmXKqkAOAS
TLSH
T10E03AEB9EC919D7B8CEAB780368F76966EF00663D8E51E48D7CD5B0C019329CB307416
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5e9e2b6e-52c9-4946-bd29-2805668e8602.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5e9e2b6e-52c9-4946-bd29-2805668e8602.tmp
Size 56KB
SHA256 d63b08bff05d48f89424aedac15d46d7df432d0c5678428e6631988d1b0fe9f5
MD5 a193646e72a209b576686421bc42282b
SHA1 6d706688fde1b77e6c1e01d84a6d0b3a84c56a0b
SHA512 bc5a26b6477bff245597d656624bd2de6b427f58a73370e13c557fad290d4df55d34ac4559f8d4dba604e6c4390fe873024d144ddd7024f3928567a485eaf5e6
SSDEEP 768:YFSslwgBg3VxDc9bsMSJz/Fns6oGH2AyEmWFCE8hWBpKfx+7PM17zeXKgtkAz8c1:VslUVQbs7JTMs24RJ3BpDbfXKqkA7AS
TLSH
T14043BEB9CC90DDBF9DEA6780B359B956AEF01263C9A85DD4D6C94D0C00A31ED6307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5f5cec08-d23f-4b6f-abce-5641b9d30e2a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5f5cec08-d23f-4b6f-abce-5641b9d30e2a.tmp
Size 38KB
SHA256 807903d0bb1b34231589692f41a8eb12dfa152ed3a0fbf1df739057f1b7185ef
MD5 1a4950d8f02f2d0b9da9eda9ff89f667
SHA1 cba874e2b1e8306b5eb62250c60fbef681ecbb90
SHA512 d4a0529da3fe33aac927eb11628677eefee99b201cdbd6ab76311860b4e0da609d9d096c20f854f4d494123c79f8cc82d12f277aee4f42dfdbf0eeaa20e8c6b6
SSDEEP 768:uszQQKnJUxDc9bsMSJz/Fn8xM/XwdOXeczkL9k:uszm2VQbs7JTcKXAOXFAS
TLSH
T168038C7E9C509CBF8CAEB780264E36666EF44237D5B81988DBC91B0D81B719CF347426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

64e3522d-4c0b-4bbe-a519-37a047f57b0d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\64e3522d-4c0b-4bbe-a519-37a047f57b0d.tmp
Size 38KB
SHA256 ee5cf95f0f5f0c3ca3493551b9b79572e16017da4654fd502c351da833ed9b97
MD5 830e6d2457e788855e3c313d68594f83
SHA1 737546e70c13449ce4e26a4086fbbb36c6b57ad0
SHA512 12926f654c9281af61b5367d9a7f617f169628a4a21f0af46bd1aa62ae44b55241d276eef71b32c98d42ddcd6d540f10f3788566c1c645bcf76a283b16bb4c0a
SSDEEP 768:W/UxvxjgC+U3EqKnJ3xDc9bsMSJz/FnGcKSHXPyK/:LZj3+U3MpVQbs7JTeSb/
TLSH
T16603CF79EC509C93DDF7A6803A8EA797AFF80993D8C52D9489DD6E0D06873AC1307427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

65f4c6e3-752c-4211-9fb8-cfe693b3b852.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\65f4c6e3-752c-4211-9fb8-cfe693b3b852.tmp
Size 34KB
SHA256 b5206bdcce69cab1fc75fae6139ef9620426631e0106b435daf171d230d511f9
MD5 8fa67be601d87a270c19c2198459884f
SHA1 1c7ce39b271cce549724032625b7690295f94d33
SHA512 a06be8cb7cc273b4b320fc193e95ffabb223c865d35239ad89d9d3e35b4de189bd03def6459288330416c4261bdbbb951278d7be3e3f13053dc15c1a1c31d9f4
SSDEEP 384:nRQkUSvs8NuEwB+p7+199fw7DJLzdvLcN9YkWwJJhoMSboCzfnFLj9HD/ewQTMzJ:DszgQKnJLxDc9bsMSJz/Fn9j/eczkL9k
TLSH
T115F2BFB5AC519DA7DDE6A680769F7697BFF00653C8C91E84D9CD6E1C02832DC230B42B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 4ee1e0056f41a046e8efbfc68a394a9993e9e1572e402e58600b2c2d27cdbad0
MD5 cbb9f3725f3320854f02b5fb7d1eee93
SHA1 9c687195aa5a8f617023a505ab65229bb9a04596
SHA512 a8e728ca1dd3f2320d59c0244f1a4c82c5213ac624c22798462d831fa8936055eccd554951d7106079089867cda6e052f87a3bef24aa908224fd8e90caa6ebfc
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Z:fwUQC5VwBIiElEd2K57P7Z
TLSH
T13DB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 97f58c0ff1008d9a744980b06de74b1bc42fdd2408c0871566ecacc80738c498
MD5 ffa34db42a6c31e411546fdfd8772d96
SHA1 cd3fa45407492f90d8b070cf009147d20a8b4151
SHA512 72fd2a1188869d257eaee37d23569752bb0744ad1a5cad19b6a4b2e60f4d5f74f1ccf0a0b24a6e31d4d512e939f7b384fb86433ec7496296acb712e8334d5e32
TLSH
T18BD02BF0529C9C63C4CA307804264581001634017548D2903601878849401B914423D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 355a29997d085f70c135b61fb8e48fe3b3d9b6030190662c9d930bd533b88c78
MD5 5121c8953b32388eb96bb70d0d12fd00
SHA1 e62d74f75b188deb1ec8b8dabcff7c16e7ba9ba5
SHA512 c8f0ff682c9ed7e02559e599a97078b0a2e39f928b301598e0196d5d9dd6ffac13da9bd34262b0120793cb2472ac6c7a93a178d4abcd0a5a2c6df1e9a193de10
TLSH
T13CD02BF4528C9C63C4CA30740425458100263401B948D2903501478849401B914433E7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 999a1b5579ddec09098fbd452982b7bfea545b3e93747faf37a7ad956711c1d3
MD5 8304ab5b501db10696b6bea802a8c9a2
SHA1 210a510578f028eb2589d500bb7dbbeeb7d3a7c0
SHA512 4cbefdc28cf2ee81b13fb03c6dd270d0ee8e6fbae2dc269f54729d03c56efb0342547fd0bf40de6de206ad5b310b419b89b97d8ae36a4aee5f06fe6a4617ad31
TLSH
T1F2D0806425163DE9C5AF71744524998055549E23B554531015030E595AD81B22CD2FFD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0bd111853a4e29e4ddac42b44d1f6053f7b9bfbe6164da05057ca9e98e5e5eb8
MD5 f793b06a8429847aabfbf9727d41744c
SHA1 30656454f4fc4132017e680c5fcc0cc88b48e597
SHA512 f6da57a51bc593e1df6994d5e1390671132cf68fa57c83a4c6a23ef1d7bc699d425d631568214e82c25c8a3d74d649920e282c9316f0e5979ecd1e6179fa7bb0
TLSH
T163D08099334FBC6DC58F7170091CD6A16514D953F098511044071A5D1BC51762CD92FC
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 19711fc57bc9724fcb43b0556c0ea21c7e51dcf9dda8fd2277149c7ae35d74cc
MD5 9895fd5baf235395133bebcc7192e72b
SHA1 72dc519062bc5f29967870e649b8393bdc2ffd81
SHA512 bec64e096dcb93e65fecf18b44d23f5508a26136598d535ba86c5cc8c1f12419379fbf35e8888211faa301761fb29ac70dc1d1881dc731e3208b9dc8c8316358
TLSH
T1EFD08095334FBC6DC59F7170091CD6B16504D953B098511044071A5D1BC51762CD92EC
MD5 SHA1 SHA512 TLSH

Submit Download

16cc474c-1689-4fe0-8cc2-b908a94e8105.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\16cc474c-1689-4fe0-8cc2-b908a94e8105.tmp
Size 13KB
SHA256 61a7c10389312c4635657ce8c4ebafba2ce716a1b955cce5b9046e4e697c6df1
MD5 356d65697b93d0acebc8c630fac75b06
SHA1 0bcb144ce955d84453eccc6bf38217d1408342b0
SHA512 068731335c9eff8e84dd0f46b9dbdb3155c93b8729a0d6f726f9d770c673a8d5af08dbfba1080a0b3200940aaff94a36d7b23c825622ef88a697f9873881d238
SSDEEP 192:sxRnR/CJ/f4si6WpVSwZlkCJPixzoA8peTb/g6+WNiXTA/LdYR1jrPgBIgDVz6Up:sxRnAJ/f4si6WvSulkCJPisk/5dd78Up
TLSH
T1D452C91AA924A87B9CC7D22CFB567F53D2FD143660915E44A6FC8A1C04EB6DD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1e8b6be3-841b-42f2-a8cb-5fe68c2d38d8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1e8b6be3-841b-42f2-a8cb-5fe68c2d38d8.tmp
Size 11KB
SHA256 ea16ea28340980a3938bf2f35a1c6ca91cedd022dcdfdab62dfa04324e02517a
MD5 10826de940bb017300dec09243dc0da8
SHA1 97b79d62a5420fd99500b98b929a0f913cae6803
SHA512 0d79eb2cf7ff4c29e29a78cbfe0e76fa723da5d3255920c2614bee65a8b1d3ab64dcf2c89d16b596bf9c7ec941fc5282dd1af5dedc7654833f64da705e630e51
SSDEEP 192:sxRnRmCJ/f4sizwZlkCczoA8peb/g6+WNUQeXYtTV5GBIgDVz6UHJ:sxRnjJ/f4sizulkCNE/52XN8Up
TLSH
T11342A816AE24A97B9CC7D219BB59BF53D6F9103260911E48F6FC8A1C04E76DD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2746f583-e7b2-48f6-b9a8-9b53eef18a98.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2746f583-e7b2-48f6-b9a8-9b53eef18a98.tmp
Size 13KB
SHA256 aa99d56388576cb5dfae8b74cc88a7a62ebef4056f411a93896ffffbfddd51d0
MD5 a007d112e4e3fda5f97f44bc16ec08d9
SHA1 a9b4f6e4d95e553839a7b98d5275fb34688c953a
SHA512 9c06f8b7440463ec1747b5df6702e94e709f0b4ee08c22fea31890903701480faba851b6952c50a63255b098c5f1a5555600dba088fa2fa269f94d802c27930d
SSDEEP 192:sxRnRLCJ/f4si6WpVSwZlkCJPixzoA8peTb/g6+WNn5TA/LdYRUj1hGBIgDVz6Up:sxRnwJ/f4si6WvSulkCJPisk/56dq8Up
TLSH
T1DD52C916AA24687B9CC7D32DFB567F53D2F9143660911F44A6FC8A1C04EB6DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

75e47c59-031c-4386-b785-fbc5b42a2246.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\75e47c59-031c-4386-b785-fbc5b42a2246.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

9a48e4f5-c4a0-49da-a10b-12873135276a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9a48e4f5-c4a0-49da-a10b-12873135276a.tmp
Size 13KB
SHA256 81daa6b70b591a54798e3015d261d09b93fe69bda9df87745b3301c094592f7a
MD5 73edf37634f6fa99c09986a7caf3f82c
SHA1 7ca6eed7efdc07674a4dd2e31c252d5632676211
SHA512 e5905a66f97be5ecb0cac175ccca85adbd1abe6ebc7df7dc6b45ebdcb434d18f197c8aa708382c3f8066677753e30d4668dc2a881759d1797f9a24650d98a59f
SSDEEP 192:sxRnR/CJ/f4siPWpVSwZlkCJPixzoA8peTb/g6+WNiXTA/LdYR1jrSGBIgDVz6Up:sxRnAJ/f4siPWvSulkCJPisk/5ddk8Up
TLSH
T1E152C81AAA28687B9CC7D22CFB567F53D2FD143660915E44A6FC8A1C04EB6DD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 f8257fb8df667051b506da813642e5acf4fabde3f02cb87d948bae76569f1394
MD5 99d8a901e1657b10caffe8973810e643
SHA1 149e073fa79aa3c48ccdbc317f9ec413103863f3
SHA512 30ab893b9edf3bcba57c7c9ea46bb9e6e60ce2d3820f6c9976b6b27adb89bc404e679483bba22ba74f8ddc370cdb159c88badaffde3ec1a668356674dbe5b74c
TLSH
T1D2E02B96D923EC370CFD476D50540796D790036B1A904D8B7E7C900DCFB663B4546C5C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 b6165cdbf8e8889235fbf18d0a78e2369658590455fbbc6e144244e93e78b0ee
MD5 1b5726dda1bd9cd4cd02ab05bb56f028
SHA1 5ac3aa8c87dd48499b7ef0f4759a65ba4a2a52fa
SHA512 7d265267864ee27982a11adab3dfa91a5f9e569ed1c73864c77792d8d06772b1e18d5695d0ef8ea5f0609c92375c29869e2b3b15fc23eca47c15954c2ababf0e
SSDEEP 192:Gff5NLizo3Mtpg884LoKRINXE5wGts2hP2y+7+5bg5GIlgiZJiS2F:GfHWE3u8AN+NX6w+gc85rlgiZJin
TLSH
T1C213A4BD7E414C92FAC7817EC4D76B7843BAEC04D2C2CE836235F644A6297467A1E42D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 10a510d7939fad972f0e704813213f916d0fde00aba3ad1d0fda14792a5938ce
MD5 93dc52fe2e9a6cf25c18f6c655ff07e9
SHA1 d427a75a835fff542c24a5eb19b71e57a9c66219
SHA512 bb1fb72daaeaf45b70e165462478a7b24a98047e83afddb6fb5a717c516ea987e51a41a99cce16b9bd242bea6ed5e1e1395a8d1f04352dd4c173d85d7548d415
SSDEEP 1536:NaTNTD5kL/PtL/2DY1ix1Om+2cD4/zM/2X:Ne5kL/1L/1UzBI2X
TLSH
T1554440F75951605BCBA852F5D2033E3DD2B7851D7CD1F8E9E1788C812825F32B2B9A48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 544eadf709b305d3fd5a0fe06e2a10815a729eda434e8222d1857752b0c223d0
MD5 d0f5306270eab57cf1e6422bcf0fc07c
SHA1 32cec5eb528f64f6380382deaf15b1c25dd44796
SHA512 1ca7ba0c7380ed04730652b110b203abc00bd360795a15b8de76e54aa2af6da3fc73b59791395632b37f69e3637859039398747ff93abe2e5f737e36e8715cb6
SSDEEP 3072:Gv9G+bW3YoHvAwMJBFBrMQQmfouoHmUA2BOQtI:GQiUMJVVQ0+bBOQtI
TLSH
T1212539EECB682C42DF6B8B70B0E0D9077E702082B65DD0D39944C5D997D2B8576E82BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 928adbaeffce20eb24a17129b3338507600801812f87ff44a9436c908eaadc77
MD5 289846267ae5851539e878a4efaa127e
SHA1 f3d3a1a0a29f215ae8c7456a1484eac753fcdf2b
SHA512 5415624d256634363578317cea80b9131768ada53bdb95d75806fdf47f871eb78bdfa979f334b3ad882ee2c71f76818cbcb1a5f8ea5267c13bb462f1e09e2ca0
SSDEEP 3072:Gv9G+bW3YoHvAwMJBFBrMQQmfouoHmUA2BOQtI:GQiUMJVVQ0+bBOQtI
TLSH
T1BE2539EECB682C42DF6B8B70B0E0D9077E702082B65DD0D39944C5D997D2B8576E82BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 f388f7c34c9972941c1922706a3a0971c32bfea76676702fb4d31301c9e4c949
MD5 3e5b2cc7925f9a16c916d06f2cbadc9e
SHA1 3434637efea02d6e5ab5146bf091b91f8acf1e08
SHA512 2e9ff1370a56373b510bcb8fe71976714712b34fc15c705ebc08a4be91aac6c1f03732d7bdf8bad732aca972245f695d0c1342d4ef64a75ace3ffbcd9bee508e
SSDEEP 12288:goWXdQZbqaIcMPQi/3Q2AAZ5C/9mjEfaUFs7f7fwDRUoviv6aKFNEPicKUbBRTJF:Uu86fH67spGzKQqNSQ3Fv
TLSH
T149166CEDCA7859C3CD63AA30B4F0E9477C7413C3F955C1D2889CC58402AB7C5BBAA669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 3c6c443edf67672eda0f9ecaa797377f9eb22594fd9aa895d1d3cef17b97e7bd
MD5 f5c46698790f8eb2fa46722ce08f9cbc
SHA1 dfa0f86b07ba7f208d0787f02b5e0eaf3181a361
SHA512 37a2d507d31171d30a0104d42e56592c2f9d9ad80a3108049586b1e9e8c2800201badc6debae23115b04066fecd0630266b039b5d01e6a96a11506bb73371e2f
TLSH
T109512C415D64C399FB9CC97084F93CBB3635AC931783EEBC806AD564F5823267200D6A
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

b5ae27a1-5581-4545-a7d3-003b54313624.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\b5ae27a1-5581-4545-a7d3-003b54313624.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 8ac61633f3340fe9c3a54fa3c242fc2844dd72d5289e1c8509820b09caa293ab
MD5 84d69a4b5ad2796e1503f78ef44936f4
SHA1 db543a53f4d4351d3abe0816b70be18946fbb2f9
SHA512 6d991e1392b7d40504cdbcd6f497c14942422fc0e770ecc676396d6460e6911a0d7bd82378aaf6bda17defdfccfe02abfec0b410c44ba31a5f93a1bc6090d1f3
TLSH
T130E0D8F565C7C12E5924348702386F0892903553DAC26D8B1B04C8C07A47005F396E97
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 399B
SHA256 55f8fa21c3f0d42c973aedf538f1ade32563ae4a1e7107c939ab82b4a4d7859a
MD5 a15ac2782bb6b4407d11979316f678fd
SHA1 b64eaf0810e180d99b83bba8e366b2e3416c5881
SHA512 370b43c7e434c6cc9328d266c1c9db327621e2c95ad13d953c4d63457a141fbf2be0b35072de96becc29048224d3646535a149229fc2ba367c7903d3e3e79bdb
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 238a47d65ed524406625ecd8ef1fefbe93a8813a4423e801e71d22ddce13c0cd
MD5 1fb91abde90efa7b22edda8fcc7bea6d
SHA1 9454edd620f72765697b738c3a90a26dec0a0230
SHA512 1122ecdd6794d07f1dc9f48c27646ad4cf718e0644a7c03dad7a64f49937fd49d4c935c52173ad3287a1b1ae7bbf3987b903fd7660e119be974119bc24d97a23
TLSH
T1A7E0869814CBC13E903AB897427CA708CBE17457A6C63D8A2F0BCD906509745A39ABD0
MD5 SHA1 SHA512 TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 a847ae0d139605c5a5d02fd4eaaff3d73a8326d8a51f15f93923e52197993b8e
MD5 2208ab3f37cebc651a5be64d7db3ed04
SHA1 9588fbbbc699f93f57e0d8978434f7327f60e3d7
SHA512 52600a77758aab7b8e3936492e6b34bdb69d3b205b68438e987f85cd7b3de6301da2a91592e26c70a13a67625ccd07dfce22c8dab1bd87aff20305a24d70d634
TLSH
T1CFE020B155DEC13F5118209B423DBB0CC7B0741BD6C87ECA1F04DD80B809104BB853D5
MD5 SHA1 SHA512 TLSH

Submit Download

2fb07ae0-64b7-4bcb-9d24-36cf7608343d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\2fb07ae0-64b7-4bcb-9d24-36cf7608343d.tmp
Size 3KB
SHA256 c69b6124b1f4be2573887ef341374dee3d650e4c8659a062f24569bc9bc2bce7
MD5 27dbc258f12542e1b6298ab4caa202be
SHA1 4f0ca5dec7fb0e960b2fe3dc0440acb18359a67d
SHA512 3eadd7711ce0e470a30d566f4e29b192298845f9e113c1ad7c3cac623856b151a818a28970cb6526b68fbb958ca8a9fcb83213b8507f11bc5e1d23301aec0afb
TLSH
T19051EFF787E8862EC91196F0A614AE2BCE1D0515432C7C5AC8E4AE1BD3E34B1D142A9F
MD5 SHA1 SHA512 TLSH

Submit Download

38105fda-3526-4712-8db2-18e10ba909cf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\38105fda-3526-4712-8db2-18e10ba909cf.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 9d46a398a69e3c5b89cfb504074405dcd2329790c916160ce9540e3264d78000
MD5 5a1b881e097c2602e32c7e4c21add301
SHA1 c4ac65e95efdd202b96650cb475247dc9a75a5cf
SHA512 8c5a218eec904ea9be3759c9e637a87e15f743752c78fd82329bfdcbfe1e9591639cb3ea7a6f86c933015ea07b5b54f084262328a1d23dad1678136c3f5071dc
SSDEEP 48:Txk/LopFMaty423w/a9NUuTjAw7oxwEZLP2t:qDeMatha9RAFbLQ
TLSH
T160B23F4D1F347221D1F44B36EDC485673E7C111C83B33A899E5860F2CDA2AAFFA060A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 97de67021507eca0fca96a902d94f598c775237def8d1469599e04ed8d2e5d6d
MD5 319056faefa3d6d5a6f96820e41ceb8a
SHA1 639e4744f805f81a03284991fe4c8d3be0f51977
SHA512 5b3ef7f42a51baf1012c2a10f364b71a2da458e9eba7b4ba72353b8795fb70a7eb3b7e64eb60b3d43a1871aa9684128018132f88b820def8c8b7bd0ddffc258d
SSDEEP 96:eIEumQv8m1ccnvS65sL6XwsMgI+cfK+cZTnFRXtd9s/vk4g:eIEumQv8m1ccnvS6CLZuqcFOW
TLSH
T1CDF2FDFF1B276201D98444F09000AB8FAF16015B47B6B6DC66E44BE3F3921E2F5B675A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 188B
SHA256 0fb7e26f7d33828f2c6ffccc6f26fef493a885cdfdf7ee79503534fc4f65c20c
MD5 d71a5b05536f61fb926a038d59be23b7
SHA1 619ad6396251f63d3c2a5a69f2c9b4e782b5ea45
SHA512 f02894c1d7881c2f023c54d15c05859b68aa5f9163340de25fa2446c36ef29eb0620ac69bb96c6aae9c1c6f84eee8028bc6f793e876e22ff28172dba4bcc750f
TLSH
T1EAC0125584F9E976106A4A7A2A84A8C57F79D439804250E5D9E6833C70950F76F2143A
MD5 SHA1 SHA512 TLSH

Submit Download

b33f4a30-01cf-4de9-be51-1f331a6004e4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b33f4a30-01cf-4de9-be51-1f331a6004e4.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

bd626391-f6de-4505-b196-417676535a7a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\bd626391-f6de-4505-b196-417676535a7a.tmp
Size 2KB
SHA256 8d8924a5889b97d8f717a7d85460c2fb945a5dc113bd16b2fd219943579c4906
MD5 4e4149dfb003e60e1472d9e0d801efe4
SHA1 0e00680aa31dda01185e26084b569c6a4e6d7eed
SHA512 dc5ae023a5793d15484783a505f5762e9c27fc1986bffd281698c96626ff83006f0a1e8a00c5813978dce3d2d7d09d0ce5bc4c4e0a90d0b32e519dd7e3923ef8
TLSH
T1ED51C1F7C7E8862EC91195F0A614BE2BCE2D0554432C7D5AC8E4AE1BD3E34B1D14269F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 cb10a508fada6d49e948a1543adf5df0430f9f128a2d5050b944755dd13851cb
MD5 cf49ff3052a42a8a2313688cfbbf73e8
SHA1 217a4e301e3d00a99176b9aaae9e684960d85c50
SHA512 0e939fbfe0979cb44c6b73456dbd178a9dfb527cc64bab962051f262246b0e2b0f5397cd9e13e4945e91888f70cd8c674ad2131026aef1bbbd1e12ff23f16c99
SSDEEP 384:sxRnAJ/f4siPWv1ulkCJPisk/5dd8qUNr:srAJ/fAY1mHo/5fs
TLSH
T1FB52C81AAA28697BDCC7D21CFB567F53D2F9103660911F48A6FC8A1C10EB6DD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 6760884d7aa6a5002bf00a784d3f5c7fa46a76076a24936a125e805835eddd59
MD5 388a390d416d1566ae2d097c3faac6f3
SHA1 750a18376ca71d6c5eb64ee4f3589874d434bd53
SHA512 29e808330b1435527760925162047d18b6e417e718f268561e53b75502e9a198996e6509cdae73b164ba99267d3965bac19bbb920a8ff88cc99daa7be36a9d70
TLSH
T1A8E0269005CAC13E602A744B02289308C3F5B527D2C43D8A2F04CE84EA86604B292290
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 cf003dc75c192f3a55da0742c39d7dffdf62aa26e8e9c396270a89b3c14b9d9a
MD5 4c89f017b8f440a7927a5437afc67611
SHA1 556a624a90a0e423b3db9e1307c4c3ff9d3bd53d
SHA512 db14fc4fddbd7f901f64d453efb0baca6266854c00b132017c473dd9946528b2e729a6b7bf40a2b1f3ed6c629f32b73bce1db0cb952a9f3e62a161805d630d94
TLSH
T1A8B012597704520AC2D7457281648FD17700F40321581E079C5CDF155E08AF8BE85881
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 7375c6471b60401a8d0643009c5de231c4a33dd38da9e0368e07e266c45f7d07
MD5 887cbbab5c4c64ba116d25344cc64402
SHA1 86932c38bc231ca05a9f270c5c609c70147aef3d
SHA512 aed939a4b54c42c4031672b4986598b87016cbfec6ae74df307f9f0e6ba51c3a7c128765ed2b7b56da26d9e9ea36a6654e153d00d81a6ad6e101b3d20e4cd31a
TLSH
T15BE04FA416CAC23F615A349F1268E318C7B3B517E6C42DAA2F08DE84E64B254B793691
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 86c92676e71bc4ba17b10ccf7819658398ebd927d200068c76ab96cfbb00587f
MD5 96944627f3e3f9847fcef8c7144f65a7
SHA1 47e3b64f59bfcdf83593d6bcbc856ff311df3dc6
SHA512 c813a4a9f127e969fbe4dbad442e3efe6ab503b53a75dd2c0c526e19e1a38ba5f4fbd5deb7d2661560d957db1b117397f19e75aa0fb43d834143ce58c7f0c31e
TLSH
T10DE04FB045CAC23E5058648E0279E74DD7F2BC1797C43ECA5B08C484A545264B3A6690
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 9bb8a49a68f58c98e736329f0317129f610233fe3f0c16adde5825bd82dc4f31
MD5 968c8c8df84b0d31c407cb16c0570967
SHA1 e4673cf158f04fd639b5f10a76f8e8044f5eb8c1
SHA512 711798cff2643d413f884ea19592c1c139d63de00e736de8de4fdfc59a48b58a3648161f5e96e790fd298b8e21ff8dda81c7ca67d925ff92acbe4add65fe6c0a
SSDEEP 48:KMds5tXr34TjerIaV4KVd9/4RVoou/tVyDzOvTt11+TlglIaz+KVL9Z+R7uoYpxB:KEKAKnKuyggKNOuacKPKF5x
TLSH
T19491545575774220383E3A0C50D8A65B42623A73306DEABF3FA940778D6AE041EFD6ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 91bb1bd5dcfa8eea4d98d8c7658c63ed1f56b6f2780c314fb6281fc5811c828d
MD5 6051c4447935ebfb6bed34768253d0f6
SHA1 ca6c89a6dacc89dd7407360201b883ab5900b5ed
SHA512 b468f5c78b33173069f353373ed368dec5cfcb7d0f9e9a8e7774392912c92e178cda2dfbe68e77e072d971ff5217e459936f9090749fe8625300e5ef3da6aebb
SSDEEP 96:KEKAKnKuyggKNOuacKPKF5O/SKUY5n2K0UCg:WLTOM5FL1g
TLSH
T16DD18695757B42703C3E3A0C4098956B52A23573306CE9BF3FA8417B4E6AE011EFDAD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 9e4f3680120fb057c6639c0c3f6c8899f20e5048983da1a6373cecc1d631eb45
MD5 ec23cdbfe80b5258be7c1f642bbd99e2
SHA1 b1fa576e6e7a9ab117af235da68e644e6d566405
SHA512 fb86b43f7e43ac4ac7e578c3fa526935ec05e5d0a101441fc258d8ad7cbf487aae5617f12a944716a165178ebfa21c358242cec45bf8c62c8a32dd078aea6d82
SSDEEP 384:DNrRZyCSDnxTICZgkMEhIKyll7svbFKfk7:xFZJSDniwgVyI1l7svbF9
TLSH
T1FA44740A7B747001EDE6D9B21CB080771E3C716D8F62E6916DA254694EB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a39e5c31-0cd6-4c9f-8a8c-6868cfcefc04.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a39e5c31-0cd6-4c9f-8a8c-6868cfcefc04.tmp
Size 29KB
SHA256 b55497afe39630329fd5967928e70b7e5a3f2f225ee651d590a0fc7bbafbb7ec
MD5 f290d84b8952661dc3a8e6e819f6d851
SHA1 00170e7eb16e99c6e1a979ab043a614817b54740
SHA512 92b35cfd22f1b84fd2ed81c7d2df92adee84295176c894c27876902bea493c8bcdedb683aa59ce0d74fb074b2a5fe6158e22b24126f34e529db565b8e025aa4d
SSDEEP 768:dmGxKM7pLuLjjsWgmMfk68F1+UoAYDCx9Tuqh0VfUC9xbog/OV6jIUGeYromLmhQ:dmGxKwEjjsWgmMfk6u1ja5jIVeji
TLSH
T1BFD2DA7B740CCB7F4F804ADDAD197A9F6DA802CB9698CD8047F9941C02C6BEB511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bfc73afb-281c-44fb-a327-c6afcd73eed6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bfc73afb-281c-44fb-a327-c6afcd73eed6.tmp
Size 11KB
SHA256 0bdb63b7c8b6e67d06856ac812db19c19807b6f51cfb4d594c2e981eb8b74e54
MD5 154b89782192f92999ea55e32629b2e5
SHA1 e4ca3edf6e65585d42a36c25091e32b27c46acf1
SHA512 8a1b0f611b0adde90087ce6a28923af8d2304a485e76d7a74034ff450d7197c7a388823cd4d833513d91edc89e33db4975b90d2a2a0b1d8f10fb88edb92bdf88
SSDEEP 192:sxRURmCJ/f4sewZlkCczoA8peb/g6+WNUnv/YtMV5GBIgVz6UHJ:sxRUjJ/f4seulkCNE/5c/GIUp
TLSH
T18242B816AE34A97B9CC7D219BB597F53D2F9103260901E48F6FC861C04EB6DE620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e2998721-6e57-4dc0-8a72-052b3a32f4ac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e2998721-6e57-4dc0-8a72-052b3a32f4ac.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e345b53a-e032-491b-8714-2bc6a7b0c603.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e345b53a-e032-491b-8714-2bc6a7b0c603.tmp
Size 12KB
SHA256 0e8fe0da9f2df2c7f4fe84ddde5f1ae1f29bf55ea1f2d9f96f417aa3ff61abdf
MD5 df7207dd92d9c2066817e37c37099734
SHA1 0dfa631759ed6b55fb4b934e2821de04eb1097ee
SHA512 c4760676f3f33be9d632f1e8218fb9cee98dc9d752a53b244a07e8bb3e8fd397b9a1b045c65e3ce20c525119446aa8629ba8334be92d6d1d9a23900e426848af
SSDEEP 192:sxRnRLCJ/f4si3WpVewZlkCczoA8peb/g6+WNn5QeXYRVN8gBIgDVz6UHJ:sxRnwJ/f4si3WveulkCNE/5fXW8Up
TLSH
T1A352B716AD24A97B9CC6D21DFB5A7F13D6F9103660911F48A6FC8A1C04EB6DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 488B
SHA256 48c944216972c5d9a18520d441fa59bdfa12b5703d3c0aad3be9f3621019ee1b
MD5 536f1bbbfba01b035a76b581796d17ec
SHA1 514ebba781ad0c38a38c1420d87615f989d5b402
SHA512 38da15ae21d55cd727dba5a4bf8ef930ed4e7660813560099191649855234d5710c9a81fce8c2436b36037ec82702fd2d54594d06e52331168d90892a67589ff
TLSH
T1B0F080C12756E0B47E8CAA40810C350370F82E75255D98F9375E86BD4B48C091B3FF76
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 f8cfbd26af27654715af4fe7975eb8bfb6592e899251900a7277b7fc55f8b6ad
MD5 96d9625d2762a689f79bd07fcc9b5840
SHA1 8812c8bffa6413facdc662d6b94523df0fa54291
SHA512 36233a789f4f1f1080f19b5645cdf64fc5cba6805911291e4f93217ec031ca817ac4ab90648572c5b9ea7d50ae015396e56f596457ae210a2d65058ee7b1cca0
SSDEEP 192:FQrIII6b6MIME1YcY9ZFeO5PAs7lrNBCsMZ:FQrIII6b6MIMiBm5IshCs
TLSH
T12E4284AF56011FB3C09F5F76136A82549BD88982407A252D72522C1F8DF3F9782D52F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 37249076b7a7236d7af8846f0274e46c115d9f57dfd16b912f12f27d23d4ce84
MD5 86a4c964115772aea296baa08c2b14c1
SHA1 f35bfd820ddb587db260fca3f35a3de40bc5f109
SHA512 98208d4e46f7ed82762e6586242ef0a62454cc69f5581db6f51adc5c6fb53f16c4e4a3f442e07d27fbffc401a1cac3bd2c4527dff0276dccd181fce514dd8718
TLSH
T1A6E02690AACBC13FA02A308702287348CBA03813EAC42DCE6F00CDC4B405200B39AA91
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 7e46a2a9afb5f9eebb77442ba472dda0c6c4cf94bcb864ecd3b2a4b59e3235f6
MD5 9a680711bb63c6c1c86dcd1d3d4f2efa
SHA1 9d402e7ba839dcb61361f8b25e282faabe73850e
SHA512 01e83879172e804ebd2faac04950a7ae2d9c473bfdf130236f129781ab51893617cdb3bdbe63df944276c03d15dd0dbd28b8caa17f1016be6257e5d8342feefa
TLSH
T14421E145F330D109E28AC63E907A9B260338D446CFBCEC4F44BA30646E71F540E4B6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 f71fe19158f41cf6c9a9d89642c034941c246c68da994f53707fc1d2319a1d1b
MD5 1d0cae49ccdd72966b9d7c7763218660
SHA1 baad14f274cf98e0f9d4679645dfef946898521d
SHA512 7d467f9f26ae4267285a43eab2f77c39c9444d1f61407a93974fada29605e50c92f0e9ad5c679a42d74e378e2a92f096d098d40a2dfda2ace1d35eb2955972a8
TLSH
T1DFE08690B9CBC17F902A70930168B34CDBA57867EAC52E8E6F04CED4B909245B39E691
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

d47a11e5-967d-4631-a012-18800f662432.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\d47a11e5-967d-4631-a012-18800f662432.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 92614446109655c29674344c1b666a23fded4c9ffd0c2351b2bc8737e06d15cd
MD5 cbb99312fc0cc53cf545434dd6fc7fac
SHA1 ec1ee218ef9209564b301a8a4f28ede1e89754a0
SHA512 34bdbf9ea36080cb0fb05665c0013e2500363c648977848551959ba3a193620ecf26796d4a97ae868f045315fe820baaa4d1c806e2233ca2b369d525c99bb5eb
SSDEEP 3:MsEllllkEthXllkl2zEfl/Jl:/M/xT02zEl
TLSH
T1644404047FC104CDC700D4304053C35053F0F410451157C335F145335CC77400C00104
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 f20c586896a094003885b8c3b6bf159af378753990240923930b4700eb35e5a2
MD5 dfad59a4e80d4458bb8d431bc66e2f53
SHA1 0bef9762e82dbef770779800b99c2adc628577db
SHA512 8209b4213ef30e88d44e797e7f5880e4bcd31bc7d8504eb60a5ed60fe7fcc5f4f1c1e4d429d618e7aa6f70ee10175d4ee4dd24f16a8775283bbf78130ee9a16a
SSDEEP 3:MsEllllkEthXllkl2zEflP:/M/xT02z+
TLSH
T1484404447FC00405C500553040F7C3505374D410051357C33CD144335CC77400C00004
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

4bbef25d-e938-4556-af96-73d88bd7d3e7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\4bbef25d-e938-4556-af96-73d88bd7d3e7.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

d78fc1cd-3940-40f4-852d-efb9ea3b4f5f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d78fc1cd-3940-40f4-852d-efb9ea3b4f5f.tmp
Size 38KB
SHA256 ca5d03477d4c88cda4a7bcabddfd323070caae29ecb5280503adac5a7231eab4
MD5 dd189ec93957921dca082018a7873b7e
SHA1 28ccb7d4d96d5bc947ad42a5db19ccf7f5afb446
SHA512 b579454c053d4c397a092673104782b7b083bf02b2b9bc49e6c066515a09a1b774db1b815f53a51b3fcc6ca61b582b38bb746a0a0e9b85a4cae676ecaa95f3b0
SSDEEP 768:nA3KsQKnJPxDc9bsMSJz/Fn/LW/XwdExeczNLu:nA3KidVQbs7JTZoXAExFBq
TLSH
T146038C7D9C509C7F8CAEB740368E366A6EE40237D5B51988DBC95B0C81B329CF747426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

12b7852d-cc76-4097-8820-78987d34b2ec.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\12b7852d-cc76-4097-8820-78987d34b2ec.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 cf4125d94d82b448cb33d6f462cf53eec00f2ee8165fa00f1b9c3bdba48e3328
MD5 8126a600a3d95922fb651e3a6f104f68
SHA1 e386add1c2c1d9ca74461e5ce0d1b271d689160f
SHA512 5a0e81111f0d9a0f7943b99f7bad8162de0d3f99fffa9d8f8ab466fa9c7c4249808bedfa6e4d26426bc2d1a422e2155900ba71adc222617a5f0880dc60b89a93
TLSH
T122C02B8F542E47CBBAA5152D42D40B3B4690CD60F199E6B449FA5640006435CC608C47
MD5 SHA1 SHA512 TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db
Size 48KB
SHA256 f35a4f569a8d6e9a53c7abbb2fdca981cdaaf4108e2934925648d90000b72a42
MD5 29f0806ef1eab44a9cac51d6178104b2
SHA1 da9a041647bf896631ff9a3a1470aec96da1eeb0
SHA512 02d7f20c525765b0a77f7738b19fedba3472edd6c259dff60db5beb1f82ebbef1c72f48fa68ede5aaf452b953f8d1b959494e48c37cde60ada7cef9e322eec56
SSDEEP 24:TLL4/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6Uw/sufL:To/IHRH34kWqB1kQnjhHmr6ITmUuL
TLSH
T14C23896EDA2CB9A1FEE40B3DD7D1D4127B36AA0EC2E4D9F1099B406746C540405EB63F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1e18c1fe-eafa-47ff-833e-94495fa5adcd.tmp

Path C:\Users\Admin\AppData\Local\Temp\1e18c1fe-eafa-47ff-833e-94495fa5adcd.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

2461d138-e25e-446e-a5d3-271b8c3a9550.tmp

Path C:\Users\Admin\AppData\Local\Temp\2461d138-e25e-446e-a5d3-271b8c3a9550.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2564_366407209\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2564_511764529\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5344_761761722\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5344_833189020\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download