Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/08/2023, 15:09

General

  • Target

    rpservicesofwiINV-234183.pdf

  • Size

    22KB

  • MD5

    7a25266f773351d9f95c0bcb348a5273

  • SHA1

    5bbea993d1e0025c07ee6f3b5b8f9c5fbbf26015

  • SHA256

    add8f5e2fb48285f61f489bab0ed52a850ab9487e83e0bc0ce9af5457fe16e75

  • SHA512

    e12fa8449c5f41b56b3d76b9495f16146fed5a0ed5f3de5fcacb52b51276bc08e547a4ded03f11242a819d6388fabde005be2324603c21c4e660f4c501099060

  • SSDEEP

    384:6wbWYZiyuhl5Nn8tdaMD8U1nQNguuN0YnAHm6ZgV2/FqEnRnTyquaGCzhp6sr:5bWYZiyuHnQuQAM2/FvnAquKht

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 30 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 31 IoCs
  • Suspicious use of SendNotifyMessage 27 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\rpservicesofwiINV-234183.pdf"
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2860
    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3624
      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B8858AFF5BE2A456512D29A267660D62 --mojo-platform-channel-handle=1756 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        3⤵
          PID:392
        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=16EB057780CEF6C00DB1B78912F960A5 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=16EB057780CEF6C00DB1B78912F960A5 --renderer-client-id=2 --mojo-platform-channel-handle=1768 --allow-no-sandbox-job /prefetch:1
          3⤵
            PID:2512
          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=208D4B78930E761F77EF00B5B107AD94 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=208D4B78930E761F77EF00B5B107AD94 --renderer-client-id=4 --mojo-platform-channel-handle=2184 --allow-no-sandbox-job /prefetch:1
            3⤵
              PID:732
            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=8CE1D2F79A04EE0A10A819455D7F8D78 --mojo-platform-channel-handle=2564 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
              3⤵
                PID:2140
              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=35B288688E54FBFE391BDF85DD698F78 --mojo-platform-channel-handle=1880 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                3⤵
                  PID:2824
                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=BED9A9371305AC315B864232DC58C224 --mojo-platform-channel-handle=2620 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                  3⤵
                    PID:3300
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://adclick.g.doubleclick.net/pcs/click?xai=AKAOjstFA55hCSrFSTBDNko3225YAz6GkouTQlHjExWXRbT5OPMnSlE8Wh4LAVp-D7jWRr-LcKW0w-HH1g8lCVAK_eU-5azfUXfjqfTiHFOFWV9I8m2ZaGczGlov1iY8kMSnelCX-AHG6VYBmpcZJapT1XbdlOM3B9u9whYqpkxEpFLbkzwDao00-DL8JyS7UIxIApb_JHANRmtKLSuRcM8IWqFaP0cOc8n8jTedmwHc8oAw2MV2tRUaAnN3eaxaESpc8fovDeWslJ0A3duo5g46YzCYxQ8A56RI5MGcQw4TZj6TeWuj6jRjAe7g0X18--IBmztC1sUi6XuHkB1Ew-z_h9bv1XK-s_9L6zeDfQPtMsI3hOqp8T8545VdgCoElxs&sig=Cg0ArKJSzEpZ_YMvCKWCEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&adurl=http://173.249.58.32/rpservicesofwiINV-234183/val
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  PID:5036
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa902746f8,0x7ffa90274708,0x7ffa90274718
                    3⤵
                      PID:5088
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,15929463517749417061,16878334465620711665,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
                      3⤵
                        PID:2420
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,15929463517749417061,16878334465620711665,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2640 /prefetch:8
                        3⤵
                          PID:2596
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,15929463517749417061,16878334465620711665,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
                          3⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:4708
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15929463517749417061,16878334465620711665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
                          3⤵
                            PID:3880
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15929463517749417061,16878334465620711665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
                            3⤵
                              PID:4088
                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,15929463517749417061,16878334465620711665,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4468 /prefetch:8
                              3⤵
                                PID:4448
                              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,15929463517749417061,16878334465620711665,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4468 /prefetch:8
                                3⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:2120
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15929463517749417061,16878334465620711665,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
                                3⤵
                                  PID:3840
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15929463517749417061,16878334465620711665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
                                  3⤵
                                    PID:2820
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15929463517749417061,16878334465620711665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
                                    3⤵
                                      PID:5264
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15929463517749417061,16878334465620711665,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
                                      3⤵
                                        PID:5272
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15929463517749417061,16878334465620711665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3916 /prefetch:1
                                        3⤵
                                          PID:2056
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15929463517749417061,16878334465620711665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
                                          3⤵
                                            PID:5488
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15929463517749417061,16878334465620711665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3908 /prefetch:1
                                            3⤵
                                              PID:5672
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15929463517749417061,16878334465620711665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3564 /prefetch:1
                                              3⤵
                                                PID:6116
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15929463517749417061,16878334465620711665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
                                                3⤵
                                                  PID:548
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2116,15929463517749417061,16878334465620711665,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4472 /prefetch:8
                                                  3⤵
                                                    PID:5500
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15929463517749417061,16878334465620711665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
                                                    3⤵
                                                      PID:4584
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,15929463517749417061,16878334465620711665,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5780 /prefetch:2
                                                      3⤵
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:7028
                                                • C:\Windows\System32\CompPkgSrv.exe
                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                  1⤵
                                                    PID:2944
                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                    "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                    1⤵
                                                      PID:1552
                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                        "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                        2⤵
                                                        • Modifies registry class
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        • Suspicious use of FindShellTrayWindow
                                                        • Suspicious use of SendNotifyMessage
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:5636
                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5636.0.1986049656\384716269" -parentBuildID 20221007134813 -prefsHandle 1904 -prefMapHandle 1896 -prefsLen 20938 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8d345901-5d09-459c-8049-c7020294f2da} 5636 "\\.\pipe\gecko-crash-server-pipe.5636" 1976 2466b0d8e58 gpu
                                                          3⤵
                                                            PID:5868
                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5636.1.149091450\123449579" -parentBuildID 20221007134813 -prefsHandle 2356 -prefMapHandle 2352 -prefsLen 20974 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {57a01f73-6315-41f3-a14e-433d79a11cc1} 5636 "\\.\pipe\gecko-crash-server-pipe.5636" 2376 2465e972558 socket
                                                            3⤵
                                                              PID:1052
                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5636.2.1569813512\179125429" -childID 1 -isForBrowser -prefsHandle 2960 -prefMapHandle 3060 -prefsLen 21077 -prefMapSize 232675 -jsInitHandle 1408 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8a5b3f49-a72b-445b-b8dd-f3c33e27464c} 5636 "\\.\pipe\gecko-crash-server-pipe.5636" 3184 2466f2b7558 tab
                                                              3⤵
                                                                PID:4428
                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5636.3.1356888854\18474843" -childID 2 -isForBrowser -prefsHandle 3828 -prefMapHandle 3824 -prefsLen 26437 -prefMapSize 232675 -jsInitHandle 1408 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {37d3e555-1745-444c-a901-14336a589fa3} 5636 "\\.\pipe\gecko-crash-server-pipe.5636" 3848 2465e968d58 tab
                                                                3⤵
                                                                  PID:6044
                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5636.4.1318144200\1770917545" -childID 3 -isForBrowser -prefsHandle 4412 -prefMapHandle 4408 -prefsLen 26496 -prefMapSize 232675 -jsInitHandle 1408 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fdf262b1-594b-4dd5-a636-0afda1060006} 5636 "\\.\pipe\gecko-crash-server-pipe.5636" 4368 2467096e858 tab
                                                                  3⤵
                                                                    PID:3176
                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5636.6.881084814\1451558444" -childID 5 -isForBrowser -prefsHandle 5244 -prefMapHandle 5248 -prefsLen 26656 -prefMapSize 232675 -jsInitHandle 1408 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {27ba2327-26f9-4715-8244-91b1196e79e3} 5636 "\\.\pipe\gecko-crash-server-pipe.5636" 5232 246717b4958 tab
                                                                    3⤵
                                                                      PID:912
                                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5636.7.2050356656\1790042326" -childID 6 -isForBrowser -prefsHandle 5512 -prefMapHandle 5508 -prefsLen 26656 -prefMapSize 232675 -jsInitHandle 1408 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0003b081-c6f3-453f-9f46-77b1095b75ee} 5636 "\\.\pipe\gecko-crash-server-pipe.5636" 5520 246717b5558 tab
                                                                      3⤵
                                                                        PID:3316
                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5636.5.2111906253\903183050" -childID 4 -isForBrowser -prefsHandle 2896 -prefMapHandle 2888 -prefsLen 26656 -prefMapSize 232675 -jsInitHandle 1408 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {35a7839f-817a-4fcc-90ba-415f44997b93} 5636 "\\.\pipe\gecko-crash-server-pipe.5636" 1724 2465e965358 tab
                                                                        3⤵
                                                                          PID:1384
                                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5636.8.1362969129\780023123" -childID 7 -isForBrowser -prefsHandle 4944 -prefMapHandle 4820 -prefsLen 27096 -prefMapSize 232675 -jsInitHandle 1408 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a885b97f-7186-4381-aedc-3ae6e2579b3f} 5636 "\\.\pipe\gecko-crash-server-pipe.5636" 2820 2466f22c458 tab
                                                                          3⤵
                                                                            PID:4984
                                                                      • C:\Program Files\Internet Explorer\iexplore.exe
                                                                        "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                        1⤵
                                                                        • Modifies Internet Explorer settings
                                                                        • Suspicious use of FindShellTrayWindow
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        PID:6372
                                                                        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6372 CREDAT:17410 /prefetch:2
                                                                          2⤵
                                                                          • Modifies Internet Explorer settings
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:6428
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                        1⤵
                                                                          PID:6744
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x120,0x124,0x128,0xf8,0xfc,0x7ffa98009758,0x7ffa98009768,0x7ffa98009778
                                                                            2⤵
                                                                              PID:6756
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1808 --field-trial-handle=2040,i,14534782759524254849,1096602057422446004,131072 /prefetch:2
                                                                              2⤵
                                                                                PID:6920
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1992 --field-trial-handle=2040,i,14534782759524254849,1096602057422446004,131072 /prefetch:8
                                                                                2⤵
                                                                                  PID:5216
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2280 --field-trial-handle=2040,i,14534782759524254849,1096602057422446004,131072 /prefetch:8
                                                                                  2⤵
                                                                                    PID:6944
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3264 --field-trial-handle=2040,i,14534782759524254849,1096602057422446004,131072 /prefetch:1
                                                                                    2⤵
                                                                                      PID:4636
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3288 --field-trial-handle=2040,i,14534782759524254849,1096602057422446004,131072 /prefetch:1
                                                                                      2⤵
                                                                                        PID:7032
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4600 --field-trial-handle=2040,i,14534782759524254849,1096602057422446004,131072 /prefetch:1
                                                                                        2⤵
                                                                                          PID:6276
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4856 --field-trial-handle=2040,i,14534782759524254849,1096602057422446004,131072 /prefetch:8
                                                                                          2⤵
                                                                                            PID:5196
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4840 --field-trial-handle=2040,i,14534782759524254849,1096602057422446004,131072 /prefetch:8
                                                                                            2⤵
                                                                                              PID:4864
                                                                                          • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                                                                            1⤵
                                                                                              PID:7152

                                                                                            Network

                                                                                            MITRE ATT&CK Enterprise v15

                                                                                            Replay Monitor

                                                                                            Loading Replay Monitor...

                                                                                            Downloads

                                                                                            • C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                                                                                              Filesize

                                                                                              56KB

                                                                                              MD5

                                                                                              752a1f26b18748311b691c7d8fc20633

                                                                                              SHA1

                                                                                              c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

                                                                                              SHA256

                                                                                              111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

                                                                                              SHA512

                                                                                              a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

                                                                                            • C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                                                                                              Filesize

                                                                                              56KB

                                                                                              MD5

                                                                                              752a1f26b18748311b691c7d8fc20633

                                                                                              SHA1

                                                                                              c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

                                                                                              SHA256

                                                                                              111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

                                                                                              SHA512

                                                                                              a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

                                                                                            • C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                                                                                              Filesize

                                                                                              64KB

                                                                                              MD5

                                                                                              230de24f3c3d609463ddd2f9a3817f48

                                                                                              SHA1

                                                                                              c0eaec32e8622b8664dd220679f5dcc22cff52aa

                                                                                              SHA256

                                                                                              ea9da4fbcf1cd71b3087396e0108505c4f2984885797720283fce3780adbbf4b

                                                                                              SHA512

                                                                                              c640f0f255d5cb10b8e7ef789ce02cae925b43c9bbae1314b6077902130c29a5cea2755d7ee336dd1d000227d3dc718d2a9c15039ccce2dfe3b52914c3b2c7b3

                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                                              Filesize

                                                                                              89KB

                                                                                              MD5

                                                                                              d5ae2f7eea6b1a37ce07f55a14eb8ce5

                                                                                              SHA1

                                                                                              ee2cb855365b7a27eeb97adeeb175bcfe26daba2

                                                                                              SHA256

                                                                                              2f7e3684d988bf5729810a474a8e5c61fd2c9cb22c15821ca92e497958871ccf

                                                                                              SHA512

                                                                                              75e0c14238be848ac6120c254ffb4b975cf35cc4f1345102db48176af7e7c2b697574cd9ff4c669672d9b5b09396fb50ee62edaa8259bd4b6133d91ba15e251a

                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                              Filesize

                                                                                              152B

                                                                                              MD5

                                                                                              fc99b0086d7714fd471ed4acc862ccc0

                                                                                              SHA1

                                                                                              39a3c43c97f778d67413a023d66e8e930d0e2314

                                                                                              SHA256

                                                                                              45ef01f81605bfd96126d5520c5aa0304c7fa7d5fdb3e4d5b2dd2bf84e2afd96

                                                                                              SHA512

                                                                                              c308fa3eda9235d67a506a5f058fefb9a769ec01d7b0d4f5a2397892cc4f8155301c55c1fac23bebacdd087ab3f47f1eacc9ff88eff4115a7d67aa7b1d6581a8

                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                              Filesize

                                                                                              111B

                                                                                              MD5

                                                                                              285252a2f6327d41eab203dc2f402c67

                                                                                              SHA1

                                                                                              acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                                                                              SHA256

                                                                                              5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                                                                              SHA512

                                                                                              11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                              Filesize

                                                                                              314B

                                                                                              MD5

                                                                                              1443ad8745fc0cb04cbff4e7ed2bc8b0

                                                                                              SHA1

                                                                                              89927193cc3f0c059514b911f3422ca5d887a248

                                                                                              SHA256

                                                                                              783c51827cd7319cd02fa3918b357b43a4bf9a8bc0fc614f05d47b95810d7d3c

                                                                                              SHA512

                                                                                              63a9c018cfebeeacf0d8fc39e7f3a3408c23f83e79a13ae4cc3a34bf4956783c99d808698e3faf8bffd02ba80557f27a15d15a7c759ce2f3f5ab7b64bdcfed92

                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                              Filesize

                                                                                              5KB

                                                                                              MD5

                                                                                              2d4d5ab128ec9e764cc6f783a54b315c

                                                                                              SHA1

                                                                                              1d31f86f682d93391628d38eed373785b8a02495

                                                                                              SHA256

                                                                                              89de073071064ac86c8b9998c15508897e9cc2be333b82462ef13309b18480cb

                                                                                              SHA512

                                                                                              efbd89df1a9446413574ea1ffc4ba65cc4b8de756e5e48c0a5e8123654f7f360912d5d3c46a2a734d2e061aacfbe3a77a2b286e04a262aee59559df7636f2415

                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                              Filesize

                                                                                              6KB

                                                                                              MD5

                                                                                              b7ec5a019896aa828576aaa18d74fb8c

                                                                                              SHA1

                                                                                              9825342c2373efc9e8a0b63a4d60269c9310ca1a

                                                                                              SHA256

                                                                                              b3e3dbe83c264a8f556a5aec9500bf50e392e14c4a4460ceed930f0282038e8f

                                                                                              SHA512

                                                                                              24e30b2e176c448aa07db168d12c3aabdb913c37eb40579e8b346071058b68814e0b1707bb8fc1c54b10f4d1462ac87678b7e5f1b0113295c19608853bbaac74

                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                              Filesize

                                                                                              5KB

                                                                                              MD5

                                                                                              50974b1fb156575b626d02933c07abf8

                                                                                              SHA1

                                                                                              2c9a5ce252f1a220c0f511ba41c6d41548140093

                                                                                              SHA256

                                                                                              a8d6560a7e7ae36b6a504d1f490bcb6e40d9e18a2409f9991d0d1ea755e1fc3a

                                                                                              SHA512

                                                                                              be1cf2be6910bb8d4668270d5e21508f02b875221d7225ff51932c68f5a2d60711aeebbf8a32b83ca1ef1ab8677d33c7cf78ca84ae26ce0092ac1054079ce5f9

                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                              Filesize

                                                                                              5KB

                                                                                              MD5

                                                                                              dea00a785c57941035ef5acd66071302

                                                                                              SHA1

                                                                                              8a6ed8aebc703f8f089ef6cc69c973207020041e

                                                                                              SHA256

                                                                                              4efe4d0b4c0b38765d133edf33d4bfb961e9a0e340662973154dde2f40ca60a9

                                                                                              SHA512

                                                                                              9e4666f6870b48fbb547f1dd488d1664bd5715abd074d4079efd9200454da33e4c700300b14ce7abae7f7d1f941358e9733fa5a717aa66c707f880d4f4976277

                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                              Filesize

                                                                                              6KB

                                                                                              MD5

                                                                                              18fb2abd8618f0f0fa854fb9e469f97d

                                                                                              SHA1

                                                                                              db6966133e04f2d4ba638bb993c342432de27dc3

                                                                                              SHA256

                                                                                              4cd530e5251424b519edb3f915dbd2dd167f212246884b752811f45a9ac18632

                                                                                              SHA512

                                                                                              d3a8ef522fabfe746e318e0923f5dc2fd8a46652ab248428ccb337e9df127033d682e0a76daecb48646cb96ab4aab12a145041a7d665294e86327e44b7850076

                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                                                                              Filesize

                                                                                              24KB

                                                                                              MD5

                                                                                              96f00bbd6a174879c58220f95f0115f5

                                                                                              SHA1

                                                                                              d3d7f82b0bf27daf1b3903bfe050c2d05422050f

                                                                                              SHA256

                                                                                              644442e740a8c0bb20f712f6f84f5bf4a81bb29d4e9446b2832ca65618961107

                                                                                              SHA512

                                                                                              e7c5e90eb85aee7b81b9c163f618ad3789a48b256040f6f00eee7fce52c60e1ff491bf0538b9c846fb115b73163710e46a45ce056e3b41ca59d88c421502ccea

                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                              Filesize

                                                                                              16B

                                                                                              MD5

                                                                                              6752a1d65b201c13b62ea44016eb221f

                                                                                              SHA1

                                                                                              58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                              SHA256

                                                                                              0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                              SHA512

                                                                                              9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                              Filesize

                                                                                              12KB

                                                                                              MD5

                                                                                              53d6fa5b57938a5daf7afbb0b34d7be8

                                                                                              SHA1

                                                                                              325f9ca0bd5803d5d8a70cc3270d72b2c0ef3c3d

                                                                                              SHA256

                                                                                              3fcc5971a48703b5882a6c4ceef4d0b55e61ec223511e08363acbf49625633cd

                                                                                              SHA512

                                                                                              b6a4952f9cee4f5227ab4c86dc1d20470ab53ccc5245014f3f7c7b1816ef809235806c31f3fab17b202f1d43c6cb25af46fac84ad13b30dfa78142124410e8c0

                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                              Filesize

                                                                                              12KB

                                                                                              MD5

                                                                                              4678cdb5f073dded5a9a382d999693a7

                                                                                              SHA1

                                                                                              d013f05fab2163f4121841431d402d8dbd7ec9ef

                                                                                              SHA256

                                                                                              3ad06842c6c176ee2437ca8399d2b40c8545ba81bfd057e7f1e3e28f4a12748b

                                                                                              SHA512

                                                                                              6fbe4a499c9edee753b08bacaf4aafbb50d31cc4ad5e0a04e368e1f626c3715f61c6494849c95535697ab18f612b67aae63e0ce771d6a2401647d6ac0de8a39c

                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                              Filesize

                                                                                              13KB

                                                                                              MD5

                                                                                              5a7ddb5c83ccff7061f7a9e4e55db5d8

                                                                                              SHA1

                                                                                              46a8a42d0cd629b8414f66187c586900457e3f1d

                                                                                              SHA256

                                                                                              d406494b6198b16dcbf3e6e6abbb576ad3e59e855383574e7c38ace7d27cca0d

                                                                                              SHA512

                                                                                              43b79dbbff6dd74fc4de86168afd1b2a1bf04b7102476c361b0f6a51adad2f6c3b52fdbede7c1da9874bf44164a40feb850f11fbcee12ceef6fc2bf649b17f84

                                                                                            • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\activity-stream.discovery_stream.json.tmp

                                                                                              Filesize

                                                                                              151KB

                                                                                              MD5

                                                                                              c057d760a5330866c8932bd4af8b19b4

                                                                                              SHA1

                                                                                              bd34b3795fa1646aaccc2b4907753fccecfe979a

                                                                                              SHA256

                                                                                              ccedb10b925f6009f0768254b45150bca42a457f957ccffb8902c9b5547d86e7

                                                                                              SHA512

                                                                                              4c2abf2ba4accb51af323585c4da7bc63165536de0fde986b7bee2122037cb1a2b89795efa69f79201908bc4b43fa7e8ef271ded8de546cbf06acd3a5cdb3db4

                                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\prefs-1.js

                                                                                              Filesize

                                                                                              6KB

                                                                                              MD5

                                                                                              4549a69360088f18e1fa6dfe4e5eea42

                                                                                              SHA1

                                                                                              fcbbbda3709957716de49b9d95239fbc577d30be

                                                                                              SHA256

                                                                                              08745161b36032a2c6ccd057ff14ac603b35c22460a6af22022a8a5060a2da8f

                                                                                              SHA512

                                                                                              2b1222b4d257e0173a307ec6fc6271bb2883b0787615bf73045f1766628324cc97ea7464c008590b9747a758ae833c636df0d954218f21d7c3c3ccbf810262ce

                                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\prefs-1.js

                                                                                              Filesize

                                                                                              6KB

                                                                                              MD5

                                                                                              5bd72dec13a4dcee966b857af6027972

                                                                                              SHA1

                                                                                              3441a29b4eb8d4ab5d113a07297a61f4428da719

                                                                                              SHA256

                                                                                              962505f68e03c2a39c6f5884335e530b590b4b80159f84e1b9e4c35f62f38a74

                                                                                              SHA512

                                                                                              708f4ae43f38a2648f611d10c8beacc4f6441bb12d780fbeef7b5b4952e128384ff78c9b7b850dfa1cefa90b2ae1fa075985866dd608db9ceca560cc78c538ea

                                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\prefs.js

                                                                                              Filesize

                                                                                              6KB

                                                                                              MD5

                                                                                              efb25076829b4bdf73c91b54bc893ccc

                                                                                              SHA1

                                                                                              e9b5fe44b16779ef6a7325a3f282175c200699ff

                                                                                              SHA256

                                                                                              1d91e507e79f1b7ba723aee87fd30c60f90de0adee94e4d0eb14fd0c920516ab

                                                                                              SHA512

                                                                                              2584397f7fc1ac6aa38ae0e0d08b32c37c0e528203da3ada2b27cbcb55fc0890a04749693a049ef160101ea1b5e0b70192ba8cac8dfbf07437cbf84027ded85b

                                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\sessionstore-backups\recovery.jsonlz4

                                                                                              Filesize

                                                                                              1KB

                                                                                              MD5

                                                                                              ac96aec7e942ff4170b2e2ee80b595c9

                                                                                              SHA1

                                                                                              7dc81d33f27e7d64b4021dda4ac07822d4e9b88c

                                                                                              SHA256

                                                                                              6636f8892cb555537571b4d47b161f452ad5d5a91f60f85a59d97e32ba048c7c

                                                                                              SHA512

                                                                                              b5611ad3d6beec237f86f320aef979e50df5f19459824e5d488b2dbaf060145241e702ca7dbba4c221c66afb82761f82f67f640470ae002b7f656649fd3e68d6

                                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\sessionstore-backups\recovery.jsonlz4

                                                                                              Filesize

                                                                                              1KB

                                                                                              MD5

                                                                                              5bd76b09fc34e578050a03bf027724e1

                                                                                              SHA1

                                                                                              65810df2c020a7ca275344094321e0118144af78

                                                                                              SHA256

                                                                                              9d0d5d6d46304778341d33562beac53bb9edd3db0edfcfa33446cee57bed03b1

                                                                                              SHA512

                                                                                              6c6abf98708c8d0f608b144dccde6f458b193b8834934f27db9f2b1128e27bc081f4d48c042cb9684b3676d5bd27b8233660a3e97904ba4812cf7aced3f7835a