9f652a9d51bb3ec1edb45540fee3e84cd9fa57c50c5aa927410d38d78359bda5

Analysis

max time kernel
148s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 02:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CVE-2020-1350-master/README.pdf
Size 4KB
Sample261027-da9a6axy7n
SHA256 9f652a9d51bb3ec1edb45540fee3e84cd9fa57c50c5aa927410d38d78359bda5
MD5 f13923f77bce3b3f30d50e1692548180
SHA1 20c383b47029f731a6729f506e65d4ef2029da0c
SHA512 9420ea6888fa77194fc56570afff9c9d4adbaefe255b72fc40e8521fca8238aea172a06d3f2dd094955eabb64203dd345879f714cb5a5a388fab7cdd0ea9279b
SSDEEP 48:3yrlnqCLcUE3RB21CQJHPuZyqXC+kjF+RqItCi8qCuth:3yJ5E3KVJD2kjsTtpD
TLSH
T1EDB1A8ED96A23D4414127C717BE4599BC49790CB28882C03795C8E5B5F00FB3BA76ED3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3456	msedge.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_286427407\_locales\eu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_286427407\_locales\lo\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_286427407\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_286427407\_locales\mn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_286427407\_locales\ja\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_286427407\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_286427407\offscreendocument.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_286427407\_locales\kk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_286427407\_locales\bn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_286427407\_locales\uk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_286427407\_locales\sk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_286427407\_locales\en\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_286427407\_locales\uz\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_286427407\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_286427407\dasherSettingSchema.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_286427407\offscreendocument_main.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_286427407\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_286427407\_locales\cy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_286427407\_locales\sq\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_286427407\_locales\fr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_286427407\_locales\am\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_286427407\page_embed_script.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_286427407\_locales\sl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_286427407\_locales\or\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_286427407\_locales\ko\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_286427407\_locales\iw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_286427407\_locales\it\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_286427407\_locales\ka\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_286427407\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\msedge_url_fetcher_3456_1266599836\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_111_1_0.crx	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_286427407\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_286427407\_locales\hu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_286427407\_locales\is\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_286427407\_locales\en_US\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_286427407\_locales\ne\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_286427407\_locales\sw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_286427407\_locales\ta\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_286427407\_locales\mk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_286427407\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_286427407\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_374177114\keys.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_1665636127\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_286427407\_locales\af\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_286427407\_locales\ml\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_286427407\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_286427407\_locales\en_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_374177114\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_374177114\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_1918852105\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_1665636127\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_286427407\_locales\et\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_286427407\_locales\ro\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_286427407\_locales\gl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_286427407\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_286427407\_locales\cs\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_286427407\_locales\tr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_286427407\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_286427407\_locales\kn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_286427407\service_worker_bin_prod.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_286427407\_locales\te\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_374177114\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_286427407\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_286427407\_locales\nl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_286427407\_locales\ar\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5584	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{F86CBD43-659E-4912-A96C-535BEBDC8AC9}	msedge.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
4628	AcroRd32.exe
4628	AcroRd32.exe
4628	AcroRd32.exe
4628	AcroRd32.exe
4628	AcroRd32.exe
4628	AcroRd32.exe
4628	AcroRd32.exe
4628	AcroRd32.exe
4628	AcroRd32.exe
4628	AcroRd32.exe
4628	AcroRd32.exe
4628	AcroRd32.exe
4628	AcroRd32.exe
4628	AcroRd32.exe
4628	AcroRd32.exe
4628	AcroRd32.exe
4628	AcroRd32.exe
4628	AcroRd32.exe
4628	AcroRd32.exe
4628	AcroRd32.exe
5500	msedge.exe
5500	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4628	AcroRd32.exe
3456	msedge.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4628	AcroRd32.exe
4628	AcroRd32.exe
4628	AcroRd32.exe
4628	AcroRd32.exe
4628	AcroRd32.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 4628 wrote to memory of 3456	4628	AcroRd32.exe	84
PID 3456 wrote to memory of 5804	3456	msedge.exe	85
PID 3456 wrote to memory of 5584	3456	msedge.exe	86
PID 3456 wrote to memory of 2548	3456	msedge.exe	87
PID 3456 wrote to memory of 2548	3456	msedge.exe	87
PID 3456 wrote to memory of 2548	3456	msedge.exe	87
PID 3456 wrote to memory of 3664	3456	msedge.exe	88
PID 3456 wrote to memory of 3664	3456	msedge.exe	88
PID 3456 wrote to memory of 5408	3456	msedge.exe	89
PID 3456 wrote to memory of 5408	3456	msedge.exe	89
PID 3456 wrote to memory of 5408	3456	msedge.exe	89
PID 3456 wrote to memory of 2484	3456	msedge.exe	90
PID 3456 wrote to memory of 2484	3456	msedge.exe	90
PID 3456 wrote to memory of 2484	3456	msedge.exe	90
PID 3456 wrote to memory of 5576	3456	msedge.exe	94
PID 3456 wrote to memory of 5576	3456	msedge.exe	94
PID 3456 wrote to memory of 5576	3456	msedge.exe	94
PID 4628 wrote to memory of 5532	4628	AcroRd32.exe	97
PID 5532 wrote to memory of 3292	5532	RdrCEF.exe	98
PID 5532 wrote to memory of 1872	5532	RdrCEF.exe	99
PID 5532 wrote to memory of 1872	5532	RdrCEF.exe	99
PID 3456 wrote to memory of 364	3456	msedge.exe	100
PID 3456 wrote to memory of 364	3456	msedge.exe	100
PID 3456 wrote to memory of 364	3456	msedge.exe	100
PID 3456 wrote to memory of 5996	3456	msedge.exe	101
PID 3456 wrote to memory of 5996	3456	msedge.exe	101
PID 3456 wrote to memory of 4728	3456	msedge.exe	102
PID 3456 wrote to memory of 4728	3456	msedge.exe	102
PID 5532 wrote to memory of 5412	5532	RdrCEF.exe	103
PID 5532 wrote to memory of 5412	5532	RdrCEF.exe	103
PID 5532 wrote to memory of 964	5532	RdrCEF.exe	106
PID 5532 wrote to memory of 5492	5532	RdrCEF.exe	108
PID 5532 wrote to memory of 5476	5532	RdrCEF.exe	109
PID 3456 wrote to memory of 4700	3456	msedge.exe	111
PID 3456 wrote to memory of 5400	3456	msedge.exe	115
PID 3456 wrote to memory of 5400	3456	msedge.exe	115
PID 3456 wrote to memory of 5400	3456	msedge.exe	115
PID 3456 wrote to memory of 6000	3456	msedge.exe	122
PID 3456 wrote to memory of 3436	3456	msedge.exe	123
PID 3456 wrote to memory of 2128	3456	msedge.exe	124
PID 3456 wrote to memory of 6052	3456	msedge.exe	125
PID 3456 wrote to memory of 6052	3456	msedge.exe	125
PID 3456 wrote to memory of 2724	3456	msedge.exe	126
PID 3456 wrote to memory of 2724	3456	msedge.exe	126
PID 3456 wrote to memory of 5044	3456	msedge.exe	128
PID 3456 wrote to memory of 5044	3456	msedge.exe	128
PID 3456 wrote to memory of 5044	3456	msedge.exe	128
PID 3456 wrote to memory of 4376	3456	msedge.exe	129
PID 3456 wrote to memory of 4376	3456	msedge.exe	129
PID 3456 wrote to memory of 2124	3456	msedge.exe	132
PID 3456 wrote to memory of 2124	3456	msedge.exe	132
PID 3456 wrote to memory of 968	3456	msedge.exe	133
PID 3456 wrote to memory of 968	3456	msedge.exe	133
PID 3456 wrote to memory of 1912	3456	msedge.exe	134
PID 3456 wrote to memory of 1912	3456	msedge.exe	134
PID 3456 wrote to memory of 1912	3456	msedge.exe	134
PID 3456 wrote to memory of 832	3456	msedge.exe	135
PID 3456 wrote to memory of 832	3456	msedge.exe	135
PID 3456 wrote to memory of 5500	3456	msedge.exe	136
PID 3456 wrote to memory of 1732	3456	msedge.exe	137
PID 3456 wrote to memory of 1732	3456	msedge.exe	137

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\CVE-2020-1350-master\README.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://29cey7dfvpl7vurecguiblsii.canarytokens.net/OMFJHDOTQHYCJWCYVJDCSJPRMGKWPCCMAW
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x338,0x7ff8e76dc188,0x7ff8e76dc194,0x7ff8e76dc1a0
    3⤵
    PID:5804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,10608926523100091372,2677703686295814517,524288 --field-trial-handle=2292,i,12389719516657590062,4475685524803571778,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1760,i,1084947604565321392,8103520523250469107,262144 --field-trial-handle=2292,i,12389719516657590062,4475685524803571778,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
    3⤵
    PID:2548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2592,i,11685240633484981263,1625107329239735128,524288 --field-trial-handle=2292,i,12389719516657590062,4475685524803571778,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:8
    3⤵
    PID:3664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,10583236015173214918,2465699318815690335,2097152 --field-trial-handle=2292,i,12389719516657590062,4475685524803571778,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
    3⤵
    PID:5408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,2773943165077131213,1621969460543297123,2097152 --field-trial-handle=2292,i,12389719516657590062,4475685524803571778,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
    3⤵
    PID:2484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4900,i,2908957849972764275,3267445080325666203,2097152 --field-trial-handle=2292,i,12389719516657590062,4475685524803571778,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:1
    3⤵
    PID:5576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3640,i,3521225016717346139,556643006909490366,2097152 --field-trial-handle=2292,i,12389719516657590062,4475685524803571778,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
    3⤵
    PID:364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,2528641957928330696,13136899590364763265,524288 --field-trial-handle=2292,i,12389719516657590062,4475685524803571778,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:8
    3⤵
    PID:5996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,3169337202893471563,8197964819460767484,524288 --field-trial-handle=2292,i,12389719516657590062,4475685524803571778,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
    3⤵
    PID:4728
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3656,i,7468356598099040120,9759280786091366264,524288 --field-trial-handle=2292,i,12389719516657590062,4475685524803571778,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:8
    3⤵
    PID:2360
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3656,i,7468356598099040120,9759280786091366264,524288 --field-trial-handle=2292,i,12389719516657590062,4475685524803571778,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:8
    3⤵
    PID:4700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4928,i,16063505758274476466,11061486604460909721,2097152 --field-trial-handle=2292,i,12389719516657590062,4475685524803571778,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:1
    3⤵
    PID:5400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3676,i,16974114130420372409,10284289363138489704,524288 --field-trial-handle=2292,i,12389719516657590062,4475685524803571778,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:8
    3⤵
    PID:6000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3740,i,4968938005273542607,1038304648026226511,524288 --field-trial-handle=2292,i,12389719516657590062,4475685524803571778,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
    3⤵
    PID:3436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,4348159893342904745,13112936538669577300,524288 --field-trial-handle=2292,i,12389719516657590062,4475685524803571778,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:8
    3⤵
    PID:2128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3520,i,9459721812111825713,10096486289362932759,524288 --field-trial-handle=2292,i,12389719516657590062,4475685524803571778,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:8
    3⤵
    PID:6052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3640,i,11468893455788513696,14098947297037337853,524288 --field-trial-handle=2292,i,12389719516657590062,4475685524803571778,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:8
    3⤵
    PID:2724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5172,i,558961563054515353,1264256096284245792,2097152 --field-trial-handle=2292,i,12389719516657590062,4475685524803571778,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:1
    3⤵
    PID:5044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4812,i,5882682490514342105,7356866775626784247,524288 --field-trial-handle=2292,i,12389719516657590062,4475685524803571778,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
    3⤵
    PID:4376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,2667048710367793374,11666174000672564598,524288 --field-trial-handle=2292,i,12389719516657590062,4475685524803571778,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:8
    3⤵
    PID:2124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,16570329491642505518,1817792615492549774,524288 --field-trial-handle=2292,i,12389719516657590062,4475685524803571778,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:8
    3⤵
    PID:968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=3692,i,17829927534874597759,8591691354049840664,2097152 --field-trial-handle=2292,i,12389719516657590062,4475685524803571778,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:1
    3⤵
    PID:1912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4572,i,17351427614122900725,8735523209896412568,524288 --field-trial-handle=2292,i,12389719516657590062,4475685524803571778,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
    3⤵
    PID:832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4876,i,11788404051590339536,2330219403332785390,262144 --field-trial-handle=2292,i,12389719516657590062,4475685524803571778,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,618741597092397515,11774590196446474374,524288 --field-trial-handle=2292,i,12389719516657590062,4475685524803571778,262144 --variations-seed-version --mojo-platform-channel-handle=1924 /prefetch:8
    3⤵
    PID:1732
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5532
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5A26112CC847E340112ADD514F0273F6 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3292
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=5C9B42B9ED538A4258CF3C53B5A30CDE --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=5C9B42B9ED538A4258CF3C53B5A30CDE --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1872
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=D74E1CB12C4B3B16DF218951DE45A449 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=D74E1CB12C4B3B16DF218951DE45A449 --renderer-client-id=4 --mojo-platform-channel-handle=2308 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5412
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=AEF1A6BB96C19F5A2B14F067F31B9944 --mojo-platform-channel-handle=2660 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:964
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=94DD53F045D1BF9C9E2F66FD7E3E6149 --mojo-platform-channel-handle=2772 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5492
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=942903515AF9FB26A80A6BFEE391BE3A --mojo-platform-channel-handle=2712 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5476

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

well_known_domains.dll

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3456_1359876084\well_known_domains.dll
Size 86KB
SHA256 f63a806e2b89ed1db25687026abff5df4675a82a13882cdb2a47d1b08d2c996e
MD5 94e3e395b95eed4fe8857e0258d62491
SHA1 0e9bb0173cb2df4be5eea77cef5a09bb5b3116b3
SHA512 b680ece7a8b72a6f78a1643ee52a606fe7a094fe058bac041c25b775dd472834a1df349d45594a11fe6eb4c41d083bdb9809e944d9ff254d795f04e177ac19d7
SSDEEP 1536:HJxEzwtlOEMkVXvopF0BYDfBny/nXi7IruMPzEVWHxgeBz4:HA2DMggpuusPXBuEuaxgEc
TLSH
T17583F14A7AAC149BE9EB8674E2645E17BB72775B071893EF1342D0040DF73C1AE35A38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

deny_domains.list

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3456_1665636127\deny_domains.list
Size 12B
SHA256 f51a7acfffec56d6751561966d947d3fd199b74528c07dabdcf5fcb33d5b2e85
MD5 085a334bdb7c8e27b7d925a596bfc19a
SHA1 1e4ad53dc335af5c6a8da2e4b4a175f37fafe2f2
SHA512 c883cb43c97a136825c6fd143f539210c234c66f9b76dfd8431f6ff014094e20b9410d7462aadee2344df8ca158def6b9a807e7cadbdfa947f6f8592e7283e34
MD5 SHA1 SHA512

Submit Download

deny_etld1_domains.list

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3456_1665636127\deny_etld1_domains.list
Size 7KB
SHA256 1c999530d7fed6e4346d8cfb3933a044055544eea970efc00b114505b9cd3a86
MD5 f3249a6b4b36c4907803ec372e4d2b14
SHA1 c8ef9da8682dc8bba70ffebee0ab4d47fcd89136
SHA512 4b7860cf50fb58c32f136e578d284f9a66dc48c9335e2e45de323f8b1429ff70115032d5c7d0555f46db2ab349f8bfd8b9e24e60d9a867055518a5f4cd7ec360
SSDEEP 192:E9KyU8bqzeC/m4XqLWPgETdT/n+DEDYZHNnd:EQy8eC/m4pzpmDZZH5d
TLSH
T19FE1B0D537C7E2D2C03580B32203ABDEAA51BD40A78A3FE5FF461AC15F55AC7511E118
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

deny_full_domains.list

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3456_1665636127\deny_full_domains.list
Size 12KB
SHA256 19e871f69e774c847717469957dd18f342712e702d2c54c5efb8542907bcbabd
MD5 85a2a44606d0d937cb7c3cb97549d1dc
SHA1 27081c556bfa37eef2ac2b0bfafecf90dfa8662d
SHA512 3f564a6b0b71ff54e3cf0e7addd91fb63a2e0d477cacaf73409fcd4c29cfa2076e76d0ca0e330c4fd0fba6cdaec8f118401bb2ce0f83af9e334cd603adb61d24
SSDEEP 192:3zjGRPX/DE6OGcrMHNK17dYuybxV3SOZTAnbtIBzkJkW9ELtW74zPJ1vRbmZM0ED:PAPYmhKh8RvOkWYtW74zBI1F71WqEgOR
TLSH
T16D42D04EF5E8A884C70E0AE50B8C759EDE0A514087A22BD53FB57B5F6988CB9FB11601
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crl-set

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3456_1918852105\crl-set
Size 13KB
SHA256 b85327be29f5d0a5be4a47da5bf5062f5115bda5e9827db40ac4776d829ccd18
MD5 5111ab39b220749a299b5bb7cd25c730
SHA1 970c9013ee629ded1b5d2a058cd147950c3544ab
SHA512 37caae776f5d9365367e12a6ca13e07761f09b3cf6d1f9ea9523af89e6f2579afdd148d3942822358a49ac597a544c30bdf070aee051d69d8a0adab6f6af708a
SSDEEP 384:oeYPnEDMU2kk0yu7uCnglcJUoCzL4pv2W9cBTgE:ojPEoMk67R1UoCwV2W0cE
TLSH
T16152AF4FDDC4A62AF03911AE982262A412794A8552554B731B6C3A64BCFB28D4E38C3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3456_374177114\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3456_374177114\_metadata\verified_contents.json
Size 1KB
SHA256 c9e76a313bb06d9d761611d7cb8c2ab8de59eb9959b77458138630dacebaeb0e
MD5 243afa1f565d5789d05d9762162cfa32
SHA1 7c7b6757be9b6ae391a59b940ddfb646cf6ce732
SHA512 671b53dd21e4566df6fb4ef811fb95382447f57a82d497de029ce1528aaaa47f26277615f6ca91ffe4834598b2a0b5b78ec2f2dabed2ef704581cbb990ad67a2
TLSH
T11F3119B8380E324F90A7E30425BB9D33534570BE13E0A517B1C26A4E5598A40B2732FA
MD5 SHA1 SHA512 TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
TLSH
T178F21D566E241E3CCA9EC336340836C34D78023DACF3B762A58A719747AD181E37D6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
TLSH
T1C94379DF2A348110CA0768BABD71771BB655D0BFC1C2F0A87AD68A1780B463CE775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 d8c9f3703d162300b9d8d55231c064c59f35a85724bc07503e469e6ea7c97d0c
MD5 37fd124f5b7126bb970b963b8ef1c00c
SHA1 f636596e7bb42ce61dffb473a654254d0527d4a6
SHA512 9bbeb44e278a673a27e253d562cc790490240a1ef53a3946a291e9646a23a57fd02588e54e4add61ab09a179ad6f11a4cd83283db3603e6010ec829b090c4149
SSDEEP 384:yeXdThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:K+eUZsLQCZsL3hUS4
TLSH
T1E253CBDB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0b2966a8-2dcc-43c7-97c7-56867c8ca87f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0b2966a8-2dcc-43c7-97c7-56867c8ca87f.tmp
Size 27KB
SHA256 e22c8928d23de0cc9dd9b32e3f8573f319695f727f9e678b756b1b03e73f23b4
MD5 848af652ae7eec086462fb143acb4439
SHA1 1637d32915064af1a8cae446fe682030f4ea1f57
SHA512 3c784c387e9bb32f17aa1636e39fa321d54ae9743792875c4f81d8d2030c2e585844f6c9f8d9076711694464ddb195649a84f1fab287c0ec220f353624af263d
SSDEEP 384:nJiFzQkUSvE3sNE8TUNTUlI4U5mgXxNK2flBVTPUVYQ/pvaTZc3bt0gL/7Iz8II/:gFdE3xwgo2HBVTP0/pvaTZcR7L/
TLSH
T1B5C25C31ECA9DDBBEDEB4B95A74A3643DEE05163C98C8AD4E5C94C5C00872DD170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4994d721-f50d-4674-b0e0-2a531e650470.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4994d721-f50d-4674-b0e0-2a531e650470.tmp
Size 27KB
SHA256 286d83e26980b487f3d674232edd4e78950ead53f480d25b7058532563781432
MD5 1f4ec66935ef5e34119702ac8fa4d82a
SHA1 9790f7bdd2e6426c1727ec729d251399a1d05a5c
SHA512 7d277119083890437a6a32255bbb324784ebaa2ce4831714efd5c8dcafdfb181a3e97d60e2b498ab88909482567ead54dff07711fddbde2b8be6675b6e1a9bbe
SSDEEP 384:ngiFzQkUSvE3sNE8TUNTUlI4U5mg5xNK2flBVTPUVYQ/pvaTZc3bt0gL/7Iz8II/:7FdE3xwgoMHBVTP0/pvaTZcR7L/
TLSH
T145C25B31ECA9DDBBEDEB4B95A74A3643DEE05263C98C8AD4E5C94C5C008729D170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6a2aef87-3ccb-4287-a096-9672cc5a8e6f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6a2aef87-3ccb-4287-a096-9672cc5a8e6f.tmp
Size 27KB
SHA256 871f3034c56ffce38793b00e0bcb184e2850ab205e2846de9cf5c098c57472c2
MD5 63fa5b15391ad376a35ce4a013f90c74
SHA1 ba3cc4b8ae73ae06f086a3c1f297fce884544eef
SHA512 5f8fae5ebecdc8529dc4e2e7580e2307928ece6434e4e2471324bf029e0d55e702f706c7399f72890e8f6d1af67e1a9e2bc354bf575c44e80f1be711e9dba9f4
SSDEEP 384:nSiFzQkUSvSZ3sNE8TUNTUlI4U5mg5xNK2flBVTPUVYQZpvaTZc3bt0gL/7Iz8IE:ZFdq3xwgoMHBVTP0ZpvaTZcR7L/
TLSH
T102C25C31ECA9EDBBDDEF4B95A74A3643DEE05263C98C8AD4E5C94C5C008729D170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7b3833f8-2215-4133-a7d3-52eaead291b2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7b3833f8-2215-4133-a7d3-52eaead291b2.tmp
Size 25KB
SHA256 b6b0290e9e2bf34f1b47f4b83cca8d48964fee52647855dfa7625398ea99570a
MD5 e25568e5f4f71e4c79d430e12c788e4c
SHA1 d60d9ea57391aa279c689358a759bad520aa7211
SHA512 bdef5746f7dd2aa7612f11c50ea37882dd2b463c7c262f6ee5adda6b071a8428444a6296b694d8499e2b21ca915290d6af9c725437d6d1e42543855526aad7c3
SSDEEP 384:nfiFiZcI63sNF8TUNTUlIm25mg5BnK2flBVTPUVDV7O6R2FeoCWgL/7Izgow:qFQ63AwgSmJBVTPyV7TR/N3
TLSH
T108C23B36EC68D9BBEDFB4F9AA70A7A07EEF00163959C8AC0D5C85D1D009759D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\6498.2026.10.20\manifest.json
Size 118B
SHA256 cc33e26f3b2efe862336389207db045cc7a916940213b9d33d845c82c12c8712
MD5 acb0c12cc7e5345764763e37bcebbec8
SHA1 4147b2615955c51a6054c807c2397e4d7d10ee03
SHA512 6777da8af66a77c28049eaf1b49ba7cdfaa08a8f381c27dad4af0e980e8d5a7ea0df0c3f1fd0cbc0cbe93a83a07d130ae24dc4057471de830fac60036b1c2f3a
TLSH
T10EB09222DC80D832697693A84E2246D0F238234B2568AA493630048C0B2E2F182A2721
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
MD5 844568391c8d79f46705230953f1d7f9
SHA1 a9cd387c1c5dddc3c8fa77739776f3408ec661d4
SHA512 85a2814e7f88919b1be438203c2053dccaf55dcefa377da5cfa8fa7daf780315b818c6b4ce3d02d6cc49b8673ba077bf7b9fd475c54c978185fc230f70cd9b53
TLSH
T13CD02B449DC43A64E942243A22185281B14489550A07244041E303940C813B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

26993f38-5ac2-48c8-8177-92aec5e7c7fc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\26993f38-5ac2-48c8-8177-92aec5e7c7fc.tmp
Size 32KB
SHA256 1cbd33e34382daefab64c3ed132a72b98251cfe83b960f1ee3f703217d0299e2
MD5 54c8341633fba2b125743b30948cccc9
SHA1 28e89b10e1e0c4678193aab2734d51eb69631602
SHA512 4d557ca12b754d3e7b73f4d57ca24f64ab7ff1f005a15d8d097e11fba2a9901fd136bf4538c072c2fd1f61eb0898f4d88d7f5fec88d65b86a2ac19e5311f45b9
SSDEEP 768:0RyktjU7pLuLbvnWvDBlt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVfwLWLlMC7fnroO:0RyktjYEbvnWvDBltu1jaewLWLywf0LS
TLSH
T10CE2EB3F780CCB7E4FC04E9DDD6A7E8B6DA802CB9598894047FA945C02C77EA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

763f771e-0fff-4ab2-b750-e2553e1e5149.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\763f771e-0fff-4ab2-b750-e2553e1e5149.tmp
Size 12KB
SHA256 f397be6ef7cc941e23c8bebb084748ea7528577094784d20f3f3ec2aa58dfbbe
MD5 51ea680d42c5769e36a8bb4337257932
SHA1 44af860fe7e825e8baa44c296874785f4ac93a92
SHA512 cb515375fda445a2a01b8c504c9e1fd6c642361997c21b5099acf52967968f8afacb25489de1f21bac725e0804cff110fce13e42f37fb18aecbb7c94130f35f7
SSDEEP 192:sxZaRUjg/fdsFQZZNINTDzodpj1H+06+WNGYbItNBY1RPJMIg5/KaJ:sxZaqg/fdsFOZNUYRHcGF9Y17Q9L
TLSH
T19E42D715AD28B97B8CCBD219FA55BF52E3F95432A0951E44A6FCCA1C04EBACD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9419b80d-58a9-4a2a-9ba4-9fa3c906e453.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9419b80d-58a9-4a2a-9ba4-9fa3c906e453.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

2e79a32d-b092-4ad0-a808-b51302ae8bca.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\2e79a32d-b092-4ad0-a808-b51302ae8bca.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

17c7d48c-3f8d-4ddc-93d1-320288a57e4d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\17c7d48c-3f8d-4ddc-93d1-320288a57e4d.tmp
Size 1KB
SHA256 d946f8a3e850b1741ea858fd630344e41c135f377f3bbd2630cfb437e8b53a93
MD5 affb0a91848cd6080adcc3f398cd4017
SHA1 aea5cdac31095b38ab763fce1ba9d7eb0ad1c5aa
SHA512 e78515c85de36d3680c7d3c75bdbe666edc03c11c4be4bb7a6d9b4c0ce8099412ff1db8cfec145e1ebdf42355ab7a2a9afd6475b4576a700cec72504f2ecbd73
TLSH
T1854181F7C3E8856E8A0196F0AA18AE2BCE2D0914432C7D5AC5E4AF6B93E3471D14155F
MD5 SHA1 SHA512 TLSH

Submit Download

c42de5c9-9cfd-4f4a-9870-6e85e24aa544.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c42de5c9-9cfd-4f4a-9870-6e85e24aa544.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

dfeffd26-caa2-49be-a66e-617e048e8eac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\dfeffd26-caa2-49be-a66e-617e048e8eac.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 52d135897c5142b514bc7323883bde984cf12a50d9746cb6140cf53c6cb6b941
MD5 f4f4c62d23f3bdd478bc40ad81b25533
SHA1 129955be6d1c3ce5b39750cc966bfa4b8160372b
SHA512 5afac6142e09698d094d663f6f986aab44cd203c7b27622d56ca2a04bd7696093df17badad65d9117ff10dcf94220e521aa6f52c46b4a1acff5cf1f6f71a004d
SSDEEP 768:OtfFvpopPxrB4Rhf4T4mxK2AsYfsryuShK4PW2LAWK:OtfFvpopPxrB4Rhf4TQ6
TLSH
T1DDB2241471BA121038FE690881B6972E464232B33159E63B7FBD45A69E6BF085CFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a01cc11e-726d-4872-9a3d-444168f588f9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a01cc11e-726d-4872-9a3d-444168f588f9.tmp
Size 12KB
SHA256 f902d6866f2575a742b786a2d4de7f02ae250f9e13fbd2587ac1707d94a37a78
MD5 f4dff691e08e375b3f2800cbf564ba42
SHA1 31abaa83c300894e004b0444c9b8715bcff46f7a
SHA512 876f2baf52b2d4537f05f41c04a036040f41dc361f19e81f1f00ed93e85c93095628a37e42393a3386d7a263de51983efd709366828655c9ffab4c911d2f9001
SSDEEP 192:sxZaRUjg/fdsGQZZNINTDzodpj1H+06+WNGYbItNBY1RPJMIgjKaJ:sxZaqg/fdsGOZNUYRHcGF9Y17QjL
TLSH
T1D342E715AD28B97B8CC7D219FB55BF52E3F95432A0941E44A6FCCA1C04EBACD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bff98ea7-b1a4-44b6-b636-3658742c3fb8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bff98ea7-b1a4-44b6-b636-3658742c3fb8.tmp
Size 12KB
SHA256 3637efcb1c94a160a9f972add6107245399cb1f5aa9c22e9dddb2908ace90662
MD5 deb068c1eefbdb5f353d5d2f30fa10e8
SHA1 168505a1123e172277ef4c8d40b70b84756ddfc8
SHA512 9de507c9c68c5e45c092a4ec5873025a5fc430346bfbe5dd9a35205c4eccdbf446622648f8b6c48d2b8424ea06b87cc167b77612124ceb3131c94c68f4e613b6
SSDEEP 192:sxZaRUjg/fdshQZZNINTDzodpj1H+46+WNGYbIRNBY1RPJMIg5xANeJ:sxZaqg/fdshOZNUYRHoGFxY17Q4Nq
TLSH
T1E342E815AE28B97B8CCBD619FB55BF52E3F95432A0851E44A6FCCA1C14EB6CD220341F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f1e77624-6ff4-4668-8bc3-b914311e6188.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f1e77624-6ff4-4668-8bc3-b914311e6188.tmp
Size 414B
SHA256 099de4ca05bcee6b21ed9d4f3c70f13e44811fd81e585e8f9830cb1357c72e99
MD5 64222bf11901a3d71694136d74389c91
SHA1 c37fa0e4cdfa44631fa871c958589aeff133c73a
SHA512 90c7ca79305a71de10e7685566277cee1d6622e7d54d037df0637cf8727a06399d1df39db6616f00845881db5533719feb2add4c1809ea63c7ec7dea626865a2
TLSH
T1BFE02BE5CD25BC3708FC1B5890A80645EB4103472A8184CF773C801D8FF1A375686D6C
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.10.12.1\keys.json
Size 3KB
SHA256 b0724d5592e6441a840c6622d7ad51caad2564a3746e563ce1f1bbde30944b2b
MD5 a86e3ddeb60db5984686f5bd89a95646
SHA1 e5f417a8f70c34b293ee20bb9f54a423a07982ec
SHA512 f3df95b51940a12ffd2d58648c302fbd649dc3097e0961a86da65e324690488d1b3d80c6267a6a0685f220a89c279ba54cb56fc02f19860e99ffcd6448cf0db5
TLSH
T19971D6BF14A40082CF3BD16A8F0735A78FB23C0623C67AC3965FE94A04425AC276F475
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.10.12.1\manifest.json
Size 80B
SHA256 abe933f0db95b1a75786da21de82feb5270ffa7ae072270923da2437710d93ba
MD5 3790d9257ba14f8be2ba08acf259a57f
SHA1 c54ab2e79d0ac9dc27425c7450e01ad593f02d60
SHA512 9568fef732369f06aafd8270638a38531a26f6f40a1c7c65fb7254eed36807789756e1c6efabaec86017b3decead2773de9ef5814650dbb334e6000ebd44a467
TLSH
T1A8A012605811E13310C403700260438243E01C112015240405461140218823713A3129
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Web Notifications Deny List\2.0.0.158\manifest.json
Size 177B
SHA256 976e13362933c4e9d37530c32a043728f47136ff030f249ade8210d4d1300df6
MD5 27f9a23b87cd0575e13bfd00ea13e3e1
SHA1 998b5c16a3c10772059819448dca88be1af7b84a
SHA512 3a1517e7d3f68d944fa540d52885c2e16d679358c8683997a407720cd6b4b194829017d07b451e58a78879e68cef66ac9e5a1cca3582034a70699709c6ad7f88
TLSH
T144C012DFDC509DB115EB4332156D43C4D733CF0B1546450935F766082E25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.3\manifest.json
Size 141B
SHA256 fe8c5046a79693a9b7f32bfc3ed7c8fdf84c5d186f5326a527ac508345a44009
MD5 3a5a48cc06d7f5cf2ec6e467e34915dd
SHA1 b6c3679e8961f0af7b5a56704992d5561ebaf6c1
SHA512 ae2de2b1827831eaeae6c9d00d081aa7be570fb050368eabc6b549469b14d7409b55e3726d4ac8ceb6cf75e48b3a88604345cb56a53f0686dd84cf8cb262125a
TLSH
T130C04C5585005D71509D87781D6C97054B12CF5618946509DDC68309EC1DCCB64B234F
MD5 SHA1 SHA512 TLSH

Submit Download

cb3e76c8-9269-4f88-9778-736ce75ad182.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cb3e76c8-9269-4f88-9778-736ce75ad182.tmp
Size 26KB
SHA256 ac0470364e139b5feb850901a86b86766e0eddab8d47f008dc655f945ad8e9ec
MD5 8d6a5b883a8a76f5219bd9ae7f45177a
SHA1 129c426bfe87a9d642696083808da39cc702390e
SHA512 fb5f4f2d57c3a870ccc8e7e5cb335d3cfd3a611c3fde596fc7c37f66844ced85939e45233ea46285fc82cf2a4bb43c15f0185d6b86fca0f3fde2d7cd6d9d4db8
SSDEEP 384:n6iFiZcI63sNo8TUNTUlIm25mgU4eK2flBVTPUVYQOp7O6R2FeoCWgL/7Izgow:xFQ63BwgS8kBVTP0Op7TR/N3
TLSH
T150C25B72E8A8DDBBECEF8B9AA74A7643DDF00163858C8AC0D5C84D1D009759D170BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

48008703-f343-4349-baa1-5218884b363a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\48008703-f343-4349-baa1-5218884b363a.tmp
Size 2KB
SHA256 2fa92bc60b79265491bc1163adbd4f64beedf4f4fa5fa014ab552771386753c2
MD5 96051b2b4384d69bedff8f514404882b
SHA1 c83a4284150d51cb676babb5a76023cade8eeb33
SHA512 6f3159f9f54bd27e4a9fe140594eed06c7d22954ef259ac66a6eab987a67cf6de98364f661904af67dc2bc5802a88ba772eb809e7867bcf437366c3fae38b3a2
TLSH
T1985130D04C396AD5D1BD0E7EB09B35EC90EC9722B4A034397859DA9C4A7E51D714483F
MD5 SHA1 SHA512 TLSH

Submit Download

4e6ad6ff-1b5b-4237-9994-f9729d7d8b12.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\4e6ad6ff-1b5b-4237-9994-f9729d7d8b12.tmp
Size 2KB
SHA256 dae0ae22bb9f91f9c1da3bd77ee31d421974c876340ab878e4d3718460d8ce35
MD5 7da6213d3ff4fe0b1500654f0ff6ecd2
SHA1 4fd002c54ba631b107d82a74ab9c5a6e0c0a0ec5
SHA512 f90dcbca3538b31d98f44065a20e356b1711d75162c468100d46784eeca4f2d989daac5fea00fe4bdaee99d5889b297b9a85a2cb39c3023935a1e3b64cae5180
TLSH
T1B15142D04C396AD1D1BC0E7EB49B35EC90E89622B490347E3858D998897E62D354483F
MD5 SHA1 SHA512 TLSH

Submit Download

c90b01eb-6380-445b-81f6-006d29b501dc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\c90b01eb-6380-445b-81f6-006d29b501dc.tmp
Size 2KB
SHA256 cfd5f388bb7a24e63134037565c13cd520f64276539cdc302ffd2bf27c0684d9
MD5 b0ef33ccb643c2863f1ca22f6eada642
SHA1 4dba8011e5eb8649daaeab5580e93eec8b8ae27e
SHA512 3ee1fb4b7f5b6157fa7887890b061fc5495fdeb48be3aa3a74c8f59937b1f2764ec72ebd6ea4d5743abba4cbad1409a5e98f6cc2f883c5b620615e6b92ca74f4
TLSH
T1D5511DE05C386AD5D1BD0EBEB49B35EC90EC9721B4A0343D7858DE9C4A7A61E718483F
MD5 SHA1 SHA512 TLSH

Submit Download

f1328dfd-57d3-4b49-952b-a0d073aefd36.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\f1328dfd-57d3-4b49-952b-a0d073aefd36.tmp
Size 2KB
SHA256 89a5905f62feb762f2f5f4a3a3c72d3f7eb1b85d051230ff7370e859378aa721
MD5 bf0e564458e569af42b30ce146c558b0
SHA1 d847d3bec66198e8c226bff369e1bea4875311df
SHA512 be7830dbf5a8a0035240591f031858370455309750a8b6f4759b86ab36d28f0536972482c23938d534231b9ebe34df27d712801540dd5fbaf2917c18d5498b87
TLSH
T1F45140D04C396AD5D1BC0E7EB09B35EC90EC9722B4A0343E7859D99C4A7E62D318083F
MD5 SHA1 SHA512 TLSH

Submit Download

3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a408ac33-87f7-4c1e-adaf-681437914bed.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a408ac33-87f7-4c1e-adaf-681437914bed.tmp
Size 132B
SHA256 cf4125d94d82b448cb33d6f462cf53eec00f2ee8165fa00f1b9c3bdba48e3328
MD5 8126a600a3d95922fb651e3a6f104f68
SHA1 e386add1c2c1d9ca74461e5ce0d1b271d689160f
SHA512 5a0e81111f0d9a0f7943b99f7bad8162de0d3f99fffa9d8f8ab466fa9c7c4249808bedfa6e4d26426bc2d1a422e2155900ba71adc222617a5f0880dc60b89a93
TLSH
T122C02B8F542E47CBBAA5152D42D40B3B4690CD60F199E6B449FA5640006435CC608C47
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c15aed02110b0b42437a859b8352f3a5dbb0458deec92bd4057bd4b6e9c1d26d
MD5 6d389ecd90656d043dfeac6fe23bbf24
SHA1 cc4896294550ccb27345ad365d8c122ae6cca439
SHA512 95635b7eabd2fcbf5bad8eff24b545ad9fd72d3c26b3a0e55dcf5822016c6ac40f280b7c8de86b8e3fe7928dcb4a62648437c52c3bdfe438aa2892a8a70638ce
TLSH
T19D411B58A6FE1148B3B36E56AFF3A95E447FBD732E0A944E00110D4F0A67A41C971737
MD5 SHA1 SHA512 TLSH

Submit Download

c7ee907f-f68a-4724-913b-b4a0f92cf985.tmp

Path C:\Users\Admin\AppData\Local\Temp\c7ee907f-f68a-4724-913b-b4a0f92cf985.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3456_1177822022\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4628-290-0x000000000B560000-0x000000000BC52000-memory.dmp

Download