ca67ef5bc74c172f9356e321ce1ef68c2139eb5e0b86b2d0ee206d826be34b4e

Analysis

max time kernel
55s
max time network
60s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-11-2024 17:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Screenshot (9).pdf
Size

31KB
MD5

f068350ac5d8f8331d15807f4579517f
SHA1

ae1deeb3d0921e0f58d8b15569955069559644b0
SHA256

ca67ef5bc74c172f9356e321ce1ef68c2139eb5e0b86b2d0ee206d826be34b4e
SHA512

4fecf8448e35b417c775e7ba29a94d2880a20d245ced7763fff950c1f14554b4f8befdc6f7c0a2acd615a99be087f501dba16f0f59d65f91f46d05c853651223
SSDEEP

768:DS5EcTSGU8o46ceXhQZJbEVWd8KfqoeN+oUGVueujWo3fDHyo+I0s2u4Lt5:fGjZ0VWuKgAfjWnLj5

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

RdrCEF.exeRdrCEF.exeRdrCEF.exeRdrCEF.exeRdrCEF.exeRdrCEF.exeAcroRd32.exeRdrCEF.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4050598569-1597076380-177084960-1000\{B081E812-550D-4E3A-99F3-F8BD60A1D10D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

Processes:

AcroRd32.exemsedge.exemsedge.exeidentity_helper.exe

pid	process
4504	AcroRd32.exe
4504	AcroRd32.exe
4504	AcroRd32.exe
4504	AcroRd32.exe
4504	AcroRd32.exe
4504	AcroRd32.exe
4504	AcroRd32.exe
4504	AcroRd32.exe
4504	AcroRd32.exe
4504	AcroRd32.exe
4504	AcroRd32.exe
4504	AcroRd32.exe
4504	AcroRd32.exe
4504	AcroRd32.exe
4504	AcroRd32.exe
4504	AcroRd32.exe
4504	AcroRd32.exe
4504	AcroRd32.exe
4504	AcroRd32.exe
4504	AcroRd32.exe
5000	msedge.exe
5000	msedge.exe
3720	msedge.exe
3720	msedge.exe
5556	identity_helper.exe
5556	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

Processes:

msedge.exe

pid	process
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe

Suspicious use of FindShellTrayWindow 27 IoCs

Processes:

AcroRd32.exemsedge.exe

pid	process
4504	AcroRd32.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

AcroRd32.exe

pid process

4504 AcroRd32.exe
4504 AcroRd32.exe
4504 AcroRd32.exe
4504 AcroRd32.exe
4504 AcroRd32.exe
4504 AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 4504 wrote to memory of 4932	4504	AcroRd32.exe	RdrCEF.exe
PID 4504 wrote to memory of 4932	4504	AcroRd32.exe	RdrCEF.exe
PID 4504 wrote to memory of 4932	4504	AcroRd32.exe	RdrCEF.exe
PID 4932 wrote to memory of 2556	4932	RdrCEF.exe	RdrCEF.exe
PID 4932 wrote to memory of 2556	4932	RdrCEF.exe	RdrCEF.exe
PID 4932 wrote to memory of 2556	4932	RdrCEF.exe	RdrCEF.exe
PID 4932 wrote to memory of 2556	4932	RdrCEF.exe	RdrCEF.exe
PID 4932 wrote to memory of 2556	4932	RdrCEF.exe	RdrCEF.exe
PID 4932 wrote to memory of 2556	4932	RdrCEF.exe	RdrCEF.exe
PID 4932 wrote to memory of 2556	4932	RdrCEF.exe	RdrCEF.exe
PID 4932 wrote to memory of 2556	4932	RdrCEF.exe	RdrCEF.exe
PID 4932 wrote to memory of 2556	4932	RdrCEF.exe	RdrCEF.exe
PID 4932 wrote to memory of 2556	4932	RdrCEF.exe	RdrCEF.exe
PID 4932 wrote to memory of 2556	4932	RdrCEF.exe	RdrCEF.exe
PID 4932 wrote to memory of 2556	4932	RdrCEF.exe	RdrCEF.exe
PID 4932 wrote to memory of 2556	4932	RdrCEF.exe	RdrCEF.exe
PID 4932 wrote to memory of 2556	4932	RdrCEF.exe	RdrCEF.exe
PID 4932 wrote to memory of 2556	4932	RdrCEF.exe	RdrCEF.exe
PID 4932 wrote to memory of 2556	4932	RdrCEF.exe	RdrCEF.exe
PID 4932 wrote to memory of 2556	4932	RdrCEF.exe	RdrCEF.exe
PID 4932 wrote to memory of 2556	4932	RdrCEF.exe	RdrCEF.exe
PID 4932 wrote to memory of 2556	4932	RdrCEF.exe	RdrCEF.exe
PID 4932 wrote to memory of 2556	4932	RdrCEF.exe	RdrCEF.exe
PID 4932 wrote to memory of 2556	4932	RdrCEF.exe	RdrCEF.exe
PID 4932 wrote to memory of 2556	4932	RdrCEF.exe	RdrCEF.exe
PID 4932 wrote to memory of 2556	4932	RdrCEF.exe	RdrCEF.exe
PID 4932 wrote to memory of 2556	4932	RdrCEF.exe	RdrCEF.exe
PID 4932 wrote to memory of 2556	4932	RdrCEF.exe	RdrCEF.exe
PID 4932 wrote to memory of 2556	4932	RdrCEF.exe	RdrCEF.exe
PID 4932 wrote to memory of 2556	4932	RdrCEF.exe	RdrCEF.exe
PID 4932 wrote to memory of 2556	4932	RdrCEF.exe	RdrCEF.exe
PID 4932 wrote to memory of 2556	4932	RdrCEF.exe	RdrCEF.exe
PID 4932 wrote to memory of 2556	4932	RdrCEF.exe	RdrCEF.exe
PID 4932 wrote to memory of 2556	4932	RdrCEF.exe	RdrCEF.exe
PID 4932 wrote to memory of 2556	4932	RdrCEF.exe	RdrCEF.exe
PID 4932 wrote to memory of 2556	4932	RdrCEF.exe	RdrCEF.exe
PID 4932 wrote to memory of 2556	4932	RdrCEF.exe	RdrCEF.exe
PID 4932 wrote to memory of 2556	4932	RdrCEF.exe	RdrCEF.exe
PID 4932 wrote to memory of 2556	4932	RdrCEF.exe	RdrCEF.exe
PID 4932 wrote to memory of 2556	4932	RdrCEF.exe	RdrCEF.exe
PID 4932 wrote to memory of 2556	4932	RdrCEF.exe	RdrCEF.exe
PID 4932 wrote to memory of 2556	4932	RdrCEF.exe	RdrCEF.exe
PID 4932 wrote to memory of 2556	4932	RdrCEF.exe	RdrCEF.exe
PID 4932 wrote to memory of 2556	4932	RdrCEF.exe	RdrCEF.exe
PID 4932 wrote to memory of 3844	4932	RdrCEF.exe	RdrCEF.exe
PID 4932 wrote to memory of 3844	4932	RdrCEF.exe	RdrCEF.exe
PID 4932 wrote to memory of 3844	4932	RdrCEF.exe	RdrCEF.exe
PID 4932 wrote to memory of 3844	4932	RdrCEF.exe	RdrCEF.exe
PID 4932 wrote to memory of 3844	4932	RdrCEF.exe	RdrCEF.exe
PID 4932 wrote to memory of 3844	4932	RdrCEF.exe	RdrCEF.exe
PID 4932 wrote to memory of 3844	4932	RdrCEF.exe	RdrCEF.exe
PID 4932 wrote to memory of 3844	4932	RdrCEF.exe	RdrCEF.exe
PID 4932 wrote to memory of 3844	4932	RdrCEF.exe	RdrCEF.exe
PID 4932 wrote to memory of 3844	4932	RdrCEF.exe	RdrCEF.exe
PID 4932 wrote to memory of 3844	4932	RdrCEF.exe	RdrCEF.exe
PID 4932 wrote to memory of 3844	4932	RdrCEF.exe	RdrCEF.exe
PID 4932 wrote to memory of 3844	4932	RdrCEF.exe	RdrCEF.exe
PID 4932 wrote to memory of 3844	4932	RdrCEF.exe	RdrCEF.exe
PID 4932 wrote to memory of 3844	4932	RdrCEF.exe	RdrCEF.exe
PID 4932 wrote to memory of 3844	4932	RdrCEF.exe	RdrCEF.exe
PID 4932 wrote to memory of 3844	4932	RdrCEF.exe	RdrCEF.exe
PID 4932 wrote to memory of 3844	4932	RdrCEF.exe	RdrCEF.exe
PID 4932 wrote to memory of 3844	4932	RdrCEF.exe	RdrCEF.exe
PID 4932 wrote to memory of 3844	4932	RdrCEF.exe	RdrCEF.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Screenshot (9).pdf"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4932
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=20622491F5B41ABDE0DBAF95BF4553B0 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2556
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=2EDAF0D7C90F6003645BCF8E23BE723B --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=2EDAF0D7C90F6003645BCF8E23BE723B --renderer-client-id=2 --mojo-platform-channel-handle=1756 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3844
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=77C98AD25C1CB3C898AB3540C516531F --mojo-platform-channel-handle=2332 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4460
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=4BD4088BD86548B8B91A490EE31D7992 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=4BD4088BD86548B8B91A490EE31D7992 --renderer-client-id=5 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2620
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2A446A497C96C65949B48ACF4831889E --mojo-platform-channel-handle=2764 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4444
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=1C9A4945DF4B9478FAB680A44B9A27A2 --mojo-platform-channel-handle=2904 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://urldefense.com/v3/__https://links.hello.g2.com/u/click?_t=03133b5014524742b22ce0c870a9368f&_m=8771a35167d14afea64bfe402a6cf8b5&_e=mIC-19ZhBjzgFR9gZsWkzjdEYvwDn1eFeiyL7Gj0W8Xnm2opMUi7YorzHGMFFElh3VOfAiNoDHMf7E96I_NKdyXHQQi39Hsdyo4EHIsZJ97-lgC2O5FVNHUg0hKegT-Tc-_Cl0K3foMAD9TfS5r0HsI4FQ6K_AzvTxcOw6DdYW4dI_rjGAzQOEo2rDnzQZxsO6zzeTJMsXD6euQcX-saLQzQlF8Mvvvh9nTOOD9_JkZoR6CZYYcW5GYY_ibvuG6pZZpJa-GkbuHoy2QVMoWXJ76j6y0Aq-5j1k6a9S8yxQapMQAYk3ZN1Ze0DXOGmfSeDjq_fV52L9oMkqun6pMKTimAwuhlg4MONJOMFMpqnMRtnsJpckdnMHJuo2VHRpt8URxXkGIssz1CHjucPkJejpf-nrRomp4q0GoQWH4-y9Bz8yeZSmG6okdWPFBHoK2m_4eh4QefmocHn_oz2Ypfu4bPK1rASOxES9iIOVQIGrnleYub4GzxW6P6dNS6ohPKvBM0yTzbXYEnifXSW8sIwKABoZcPovV4FXAKt50xlUBpn9-h8oz90YWvuHO4Bg6V__;!!PrnngaAx4byl!xhNn_GlsZor9fKzKFVcJUhEzH-wX6VZcGmHILWrI34HnS23IPKKoybIrIQMh5IO0R2feZZZbQ0zUEjdkuc205f-7r4rq$
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc531946f8,0x7ffc53194708,0x7ffc53194718
    3⤵
    PID:2936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,11263354621841571274,14883657581249801721,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
    3⤵
    PID:3168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,11263354621841571274,14883657581249801721,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,11263354621841571274,14883657581249801721,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
    3⤵
    PID:2420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11263354621841571274,14883657581249801721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
    3⤵
    PID:4784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11263354621841571274,14883657581249801721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
    3⤵
    PID:2200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11263354621841571274,14883657581249801721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:1
    3⤵
    PID:4996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11263354621841571274,14883657581249801721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2312 /prefetch:1
    3⤵
    PID:516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2068,11263354621841571274,14883657581249801721,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5476 /prefetch:8
    3⤵
    PID:4468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2068,11263354621841571274,14883657581249801721,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5488 /prefetch:8
    3⤵
    - Modifies registry class
    PID:2424
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,11263354621841571274,14883657581249801721,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6040 /prefetch:8
    3⤵
    PID:5540
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,11263354621841571274,14883657581249801721,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6040 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11263354621841571274,14883657581249801721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
    3⤵
    PID:5712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11263354621841571274,14883657581249801721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
    3⤵
    PID:6004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11263354621841571274,14883657581249801721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
    3⤵
    PID:5224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11263354621841571274,14883657581249801721,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:1
    3⤵
    PID:5232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11263354621841571274,14883657581249801721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3548 /prefetch:1
    3⤵
    PID:5456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11263354621841571274,14883657581249801721,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3624 /prefetch:1
    3⤵
    PID:5460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11263354621841571274,14883657581249801721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2936 /prefetch:1
    3⤵
    PID:5976

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
d517a9db1269b18553f30b2611c1a0ff

SHA1
b88cedd6b1bbf307ee88e59506a314fc9be2cbdb

SHA256
3c1726ad6fea0f258c7d2227ce1463e3921c637b90bb76312b691856666b79f3

SHA512
782596b5210763ec193536df99b2dee6f7421911251d9c355f1071921765f62d1ccc9cb59ad6ea46b81049f6811393bfd2299339e56b0a571633b02d6288348f

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
36KB

MD5
b30d3becc8731792523d599d949e63f5

SHA1
19350257e42d7aee17fb3bf139a9d3adb330fad4

SHA256
b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

SHA512
523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
56KB

MD5
752a1f26b18748311b691c7d8fc20633

SHA1
c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

SHA256
111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

SHA512
a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e443ee4336fcf13c698b8ab5f3c173d0

SHA1
9bf70b16f03820cbe3158e1f1396b07b8ac9d75a

SHA256
79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b

SHA512
cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56a4f78e21616a6e19da57228569489b

SHA1
21bfabbfc294d5f2aa1da825c5590d760483bc76

SHA256
d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb

SHA512
c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
960B

MD5
b826c3acf7913835cf23829c897a5976

SHA1
b7d01ed73a430a57c279d5121813b83abae72d64

SHA256
c6d82b6262cd04ba110f8b9388726c151c7ee1ea93fbca8f7d0db3f1b21a6747

SHA512
1f2f1410fe18302193734c31d7e1266b9e280487144c732c8c9b1ac05e142287d77c3fe671676db2ae56e32fb46982330afa3ba7de0678c1d111581afcf1cd63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

Filesize
393B

MD5
ef26c654c1bfa111cdb85815d420fc4d

SHA1
69838940cf38fbc7a192998a8f61971a567c8831

SHA256
636c3e7015b01c5c92721aeea123ae9a3d06d68bd058e17dfae54067f0ee1234

SHA512
fc7057ab4c593f999894c48a099d828749d46c50ea950d7339d4e8841551a40b12c7269e10ab7f0c13090c8ddc72475c92ff28297ff11ae24cb80f3bdea70aff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

Filesize
396B

MD5
b4f08618e52d7d1b2d1e06c7b64e8cfb

SHA1
47291763c47dd1612ba7074f8cf6f7fb13fe398c

SHA256
2869425a6481c9327ffb89f7cb0ca1b4a90d276cfafcebf0bff5fef23318003d

SHA512
93d44282d345c7ae7c3bb27da2560d97845d3d0f6e84d43b11764d8dfa4ed97da378fea64fb00e65928c3b13f0c86263b4b1f1c8509c05b059c891a2dc4c18c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old~RFe587470.TMP

Filesize
355B

MD5
05396393fe5607b7e4944913101da983

SHA1
5fce1c129e3c764fd516d95a65b9b7edc7cbfcf3

SHA256
c70d25a0867e51e3a367f694ee579b1b67997eb177b9e9300c2e1001517d86a3

SHA512
03fe96a003e29a32e6e123036e291967eff7cc337c987266966764d910045946f2397cfa11129bedff6f223c94a194af29da9fa516e89489846381100160d46d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
3a1c99f04b3a3e291b20f99868043830

SHA1
1594c7cb18de90cd1f8586edb1b4fbf8e089bfe7

SHA256
9329b103700e023a5edf5ccd512db5c811d260a9235ef52150bbd6747d6dd49a

SHA512
bb0fb5800c8654859d38d38144b9249f3649a6ac943a00c8dfbc267692d4a29f119c7a9b68034353e5ac479aa1f6e8d4e6d6b97fdd6ff05f229ec9c9f972f398

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6cc5e854298545e98d7465069a547810

SHA1
85aeb98893b4d167cf4469356153cd3ca5e347fb

SHA256
10682c292d1d494f83e83d36898c13e99a5f3003e99a5c3e0fd89d52ba611f85

SHA512
2a335433bbfc0e0c67718d5ccdef32fba388a8ee3a443b37a59f0b7cae535049bcdfb0a6d1378686ef4254481d32d8975087a6652c953c9d3ba9f110441d03ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b75ac8b5a74f9978184f18edca1affcc

SHA1
f7d9f7e1c7d2ac8a56f80b80287c3c39172d0bab

SHA256
10e0b9079670f534b4c16d9d35b71622c484a8c6a135a2992139a1276d581321

SHA512
d87ff9a0243a515bf0972becbbdcc23d45ce514285f27436db7321d7ec38e004913e8590f715f398f601b765ca5d2a405c64d4bc6d923bfe51ab568b3cea92ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
5967b6fd74c1afda17f39e93296c8334

SHA1
05f4478cd11129a55216647fd8b92bdb198b65a3

SHA256
a114d0373ccb41e2e67d91e01620c3a8f21fdd7edb0d410f3c6d2dca3ce56ae7

SHA512
06e378e590fad527edc2270eae82a88fadc376c4a80d3d03b2535d7c799d64991eed6dce281f0de9be9d7f86a16cfdf9a1ca848569ffcc0b1f6de05ac4a31fa4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
eb3ac407ca135451661ea36440117f0a

SHA1
b4ce40c8f9998a2766e37c70c7dcff74b2fc5d09

SHA256
914a1108275c9fa73642c3cb08adddb830c70be7a317781999d03029dad5d390

SHA512
7d7845eba2ce753514517947f88e84886ce13e324b7434ac12cbdf1bcfe94c11cdf9be4a4178393a6fdf7e27e5e0ba41bb94cedb15de5593e3b525b019bde0e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
de8ce096f7daa11c20d771666336ee2b

SHA1
0166d91c479fdd57c5f208d02ca0574c5a7db474

SHA256
39e1ad313a8ca0eb4a32ebe48a8315580aab9d0da56ebf24b615349c5dff65bd

SHA512
da0208ca312fd3a89770bf90fac598c053e31053b21e57f031d3922f7dbbb3ed5c2fd691d04e822e74f1f60dbdb1ca7967afce4cf3ecc60d4c65b916e16d6a5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe585687.TMP

Filesize
48B

MD5
1551c324bae2685038b3298f02c67610

SHA1
502c82dd13255a5bff7eece2614578fdd1df3308

SHA256
29ae9ce17cd2e5443cd4c2cf425f646b0675744dda1c5ee61deb65983116449c

SHA512
e8686999c2be23511f38c5986a186ff5ab884ca967291cec8f1f824474c0961978601cf9e4b4742b91351788df0addeb09c96af4346c90635a978f90b8452db1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1b514379171c7dd4ec844322fdf0cafd

SHA1
0a33441893cbb866eb0f55f776b51513f7023ec3

SHA256
39c0940fc6c8d6fd2df0be565188ec4f0d52d6a27fa786c8382a0663084fce8c

SHA512
741349bc01e913b50850ced749f336e20cf7504385d0edaf6e7cc92905f8498cd98f3c2b3e5b1079183e994376d8d707ce7bbbc98e42d73b6842e95ccdd626b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
22539a9d77c42a8e3ab7211978735546

SHA1
2276919926f3328df68946b5e3208451e11f39c0

SHA256
34435fdfc964c68a5699a277f13a78bd6f486b4bee5d377162835dde1c1f397e

SHA512
256e83e1bdc971579c610badfa422027ae0c6dcb7fd4fc58ca385e11982c174c8029f008203089e61239701f32e506fee9eb9de6329740901c1fc9a625871a1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585752.TMP

Filesize
1KB

MD5
fefb02f7bf9b033461e833e9a92670b7

SHA1
780cba7aa27a6661273ed74f77af740deccbc092

SHA256
a44323609580559a8dfe89c2ae80ed37fc8dd94f8547f3b0eaeb830992f6dff2

SHA512
38af3d98d1bbee61320535c20c20d813a5e333012b06e96da5db8e9b43194ab318c02709147c55c839b3881d954d9440540239bb875f12927a477ee3df8496c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
44033251c8805047c1ae599fc6c54125

SHA1
371017db62c7434c5180d1379f874472419daa5f

SHA256
34534028e553aacb44848dbcfb610b3cadfe7c6805dfb2615e6dbfa3d6713791

SHA512
705034a392960872301db5b4ab8ee5e83daca7d5aa573bcc1955c09fd461ecb946312e6ce3225a74a17fbaccfeeed48c66a3d6f2857c047f8e55f8e36a1f8fbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2ad4b449b04e4f6034011c46a6c48064

SHA1
cb7d8020c3eec4c641b4538ae0f17e9cfa3e21cd

SHA256
ab2e20bbc25e91f571b03f7ee48c7e124bf859d203db3d22e237f96a0dcb5f71

SHA512
17e34247be05cdf48d9bfc5c3a9691e938763f8d478ecf04e28e960b803b05ceff0167a4897627ecc19819caf22eb0f044b451457169ec83aab1f571857c579e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
\??\pipe\LOCAL\crashpad_3720_CRQRSGRDBLIPWICD

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit