ec8b38a258d1ce3b2e58c827eb075e5183b9d55f88fae271e655f5f4811b1b9a

Resubmissions

13/01/2025, 20:48

250113-zlhhgazlam 3

13/01/2025, 20:45

250113-zj3qmaxkgx 5

Analysis

max time kernel
112s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/01/2025, 20:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Screenshot - 2025-01-13T154507.932.pdf
Size

24KB
MD5

967f4ebb0d9f9710a1d3a9a39f594ad9
SHA1

c98504b59121e4a1e1dc1d7b1540b6e3cc7e6a90
SHA256

ec8b38a258d1ce3b2e58c827eb075e5183b9d55f88fae271e655f5f4811b1b9a
SHA512

c7b7158d0fdb24e3dab7ad02b9cd7b5ab77b2019d49925ca26d141a2b37b34767deca4d4bb6c0a24bb95d72a89de37a8b46bcc5e03b79464d1aa45e06404f61e
SSDEEP

384:eXPN4b9YMWv7oh+phMQigG/J1tzGs1IHblCUSAWX0fDVMnh+sJghxbQDCUSFA:6PN4b+MWv8hpngGB10HhLWEfZMhJwQDV

Score

5^/10

paypal discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand PAYPAL.
phishing paypal
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4089630652-1596403869-279772308-1000\{3D1688C7-53EB-4FE9-9C50-2D6768BFAE25}	msedge.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
2460	msedge.exe
2460	msedge.exe
640	msedge.exe
640	msedge.exe
5140	identity_helper.exe
5140	identity_helper.exe
1988	AcroRd32.exe
1988	AcroRd32.exe
1988	AcroRd32.exe
1988	AcroRd32.exe
1988	AcroRd32.exe
1988	AcroRd32.exe
1988	AcroRd32.exe
1988	AcroRd32.exe
1988	AcroRd32.exe
1988	AcroRd32.exe
1988	AcroRd32.exe
1988	AcroRd32.exe
1988	AcroRd32.exe
1988	AcroRd32.exe
1988	AcroRd32.exe
1988	AcroRd32.exe
1988	AcroRd32.exe
1988	AcroRd32.exe
1988	AcroRd32.exe
1988	AcroRd32.exe
4688	msedge.exe
4688	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
1988	AcroRd32.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1988	AcroRd32.exe
1988	AcroRd32.exe
1988	AcroRd32.exe
1988	AcroRd32.exe
1988	AcroRd32.exe
1988	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 744	1988	AcroRd32.exe	83
PID 1988 wrote to memory of 744	1988	AcroRd32.exe	83
PID 1988 wrote to memory of 744	1988	AcroRd32.exe	83
PID 744 wrote to memory of 3140	744	RdrCEF.exe	84
PID 744 wrote to memory of 3140	744	RdrCEF.exe	84
PID 744 wrote to memory of 3140	744	RdrCEF.exe	84
PID 744 wrote to memory of 3140	744	RdrCEF.exe	84
PID 744 wrote to memory of 3140	744	RdrCEF.exe	84
PID 744 wrote to memory of 3140	744	RdrCEF.exe	84
PID 744 wrote to memory of 3140	744	RdrCEF.exe	84
PID 744 wrote to memory of 3140	744	RdrCEF.exe	84
PID 744 wrote to memory of 3140	744	RdrCEF.exe	84
PID 744 wrote to memory of 3140	744	RdrCEF.exe	84
PID 744 wrote to memory of 3140	744	RdrCEF.exe	84
PID 744 wrote to memory of 3140	744	RdrCEF.exe	84
PID 744 wrote to memory of 3140	744	RdrCEF.exe	84
PID 744 wrote to memory of 3140	744	RdrCEF.exe	84
PID 744 wrote to memory of 3140	744	RdrCEF.exe	84
PID 744 wrote to memory of 3140	744	RdrCEF.exe	84
PID 744 wrote to memory of 3140	744	RdrCEF.exe	84
PID 744 wrote to memory of 3140	744	RdrCEF.exe	84
PID 744 wrote to memory of 3140	744	RdrCEF.exe	84
PID 744 wrote to memory of 3140	744	RdrCEF.exe	84
PID 744 wrote to memory of 3140	744	RdrCEF.exe	84
PID 744 wrote to memory of 3140	744	RdrCEF.exe	84
PID 744 wrote to memory of 3140	744	RdrCEF.exe	84
PID 744 wrote to memory of 3140	744	RdrCEF.exe	84
PID 744 wrote to memory of 3140	744	RdrCEF.exe	84
PID 744 wrote to memory of 3140	744	RdrCEF.exe	84
PID 744 wrote to memory of 3140	744	RdrCEF.exe	84
PID 744 wrote to memory of 3140	744	RdrCEF.exe	84
PID 744 wrote to memory of 3140	744	RdrCEF.exe	84
PID 744 wrote to memory of 3140	744	RdrCEF.exe	84
PID 744 wrote to memory of 3140	744	RdrCEF.exe	84
PID 744 wrote to memory of 3140	744	RdrCEF.exe	84
PID 744 wrote to memory of 3140	744	RdrCEF.exe	84
PID 744 wrote to memory of 3140	744	RdrCEF.exe	84
PID 744 wrote to memory of 3140	744	RdrCEF.exe	84
PID 744 wrote to memory of 3140	744	RdrCEF.exe	84
PID 744 wrote to memory of 3140	744	RdrCEF.exe	84
PID 744 wrote to memory of 3140	744	RdrCEF.exe	84
PID 744 wrote to memory of 3140	744	RdrCEF.exe	84
PID 744 wrote to memory of 3140	744	RdrCEF.exe	84
PID 744 wrote to memory of 3140	744	RdrCEF.exe	84
PID 744 wrote to memory of 4596	744	RdrCEF.exe	85
PID 744 wrote to memory of 4596	744	RdrCEF.exe	85
PID 744 wrote to memory of 4596	744	RdrCEF.exe	85
PID 744 wrote to memory of 4596	744	RdrCEF.exe	85
PID 744 wrote to memory of 4596	744	RdrCEF.exe	85
PID 744 wrote to memory of 4596	744	RdrCEF.exe	85
PID 744 wrote to memory of 4596	744	RdrCEF.exe	85
PID 744 wrote to memory of 4596	744	RdrCEF.exe	85
PID 744 wrote to memory of 4596	744	RdrCEF.exe	85
PID 744 wrote to memory of 4596	744	RdrCEF.exe	85
PID 744 wrote to memory of 4596	744	RdrCEF.exe	85
PID 744 wrote to memory of 4596	744	RdrCEF.exe	85
PID 744 wrote to memory of 4596	744	RdrCEF.exe	85
PID 744 wrote to memory of 4596	744	RdrCEF.exe	85
PID 744 wrote to memory of 4596	744	RdrCEF.exe	85
PID 744 wrote to memory of 4596	744	RdrCEF.exe	85
PID 744 wrote to memory of 4596	744	RdrCEF.exe	85
PID 744 wrote to memory of 4596	744	RdrCEF.exe	85
PID 744 wrote to memory of 4596	744	RdrCEF.exe	85
PID 744 wrote to memory of 4596	744	RdrCEF.exe	85

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Screenshot - 2025-01-13T154507.932.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:744
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=56118F7889379A6C259E68F139E7B9B9 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3140
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=7AAC88D0C8A147039F0B648336193882 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=7AAC88D0C8A147039F0B648336193882 --renderer-client-id=2 --mojo-platform-channel-handle=1760 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4596
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=60D6BCE40B963D40CC471E650CC02A82 --mojo-platform-channel-handle=2320 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2580
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=1271B6231E2A0EEDEB199AB56A4C49BF --mojo-platform-channel-handle=1772 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4028
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=303D6DF8BDCE0EFCAFB20BF899E35DC0 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=303D6DF8BDCE0EFCAFB20BF899E35DC0 --renderer-client-id=6 --mojo-platform-channel-handle=2324 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3484
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=378BE6752C93E16FC7CD2548DA50EB37 --mojo-platform-channel-handle=1716 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://bosing.uz/sCtjW
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe013a46f8,0x7ffe013a4708,0x7ffe013a4718
    3⤵
    PID:4600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,15821216136274539751,740450469306024354,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
    3⤵
    PID:1948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2032,15821216136274539751,740450469306024354,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2032,15821216136274539751,740450469306024354,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
    3⤵
    PID:2808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,15821216136274539751,740450469306024354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
    3⤵
    PID:3476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,15821216136274539751,740450469306024354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
    3⤵
    PID:3064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,15821216136274539751,740450469306024354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
    3⤵
    PID:2952
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,15821216136274539751,740450469306024354,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 /prefetch:8
    3⤵
    PID:1516
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,15821216136274539751,740450469306024354,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,15821216136274539751,740450469306024354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
    3⤵
    PID:5984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,15821216136274539751,740450469306024354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
    3⤵
    PID:5992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2032,15821216136274539751,740450469306024354,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5844 /prefetch:8
    3⤵
    PID:5632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,15821216136274539751,740450469306024354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
    3⤵
    PID:5772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,15821216136274539751,740450469306024354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
    3⤵
    PID:5408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,15821216136274539751,740450469306024354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2548 /prefetch:1
    3⤵
    PID:5740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2032,15821216136274539751,740450469306024354,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3392 /prefetch:8
    3⤵
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:4688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,15821216136274539751,740450469306024354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2556 /prefetch:1
    3⤵
    PID:5964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,15821216136274539751,740450469306024354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6200 /prefetch:1
    3⤵
    PID:2276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,15821216136274539751,740450469306024354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6408 /prefetch:1
    3⤵
    PID:3416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,15821216136274539751,740450469306024354,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6424 /prefetch:1
    3⤵
    PID:3028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,15821216136274539751,740450469306024354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2552 /prefetch:1
    3⤵
    PID:2664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,15821216136274539751,740450469306024354,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6336 /prefetch:1
    3⤵
    PID:2676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3328

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4c8 0x4f4
1⤵
PID:5668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
56KB

MD5
752a1f26b18748311b691c7d8fc20633

SHA1
c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

SHA256
111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

SHA512
a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
dbeaebaf926079efdd72c6f81665e12d

SHA1
6a2ac9c1510c30c420c8e6af588ffaa542a0f1db

SHA256
37919a3fd0f2819da6a9b8740fa295b43971a57f74b6f91166fefdfed96f2842

SHA512
2767c067b839065413642859598d1bb2d17bd9a1f3f2f998191adb768d7f53495943701f99a552de3ec484eebeb86952e9ce9906ee43b2d274822774c978a0a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
36KB

MD5
b30d3becc8731792523d599d949e63f5

SHA1
19350257e42d7aee17fb3bf139a9d3adb330fad4

SHA256
b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

SHA512
523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

Filesize
471B

MD5
f2f868ae97c3aeaf74550089e474e64b

SHA1
3c11873d75bfc9fa0fe7a01e42394c0c6de57679

SHA256
52e4867b819c4eac723770445a7f230c9f79a925dc8e48b001624d9db422e3e3

SHA512
647267992b2c529d21c87a31b7f66d749194c108af8834599f8668600e960b037bdf8589ef031bc92579f32a2786c531ba2bdacf60208620681b9cd81ea1595a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

Filesize
400B

MD5
fcea7e46628456d6c61bdc089f8cf412

SHA1
dc4843d0e8f7a51d207343eb24f7d8955fa92cde

SHA256
44931a729e236425603865259adadc2dba4bff32549f471c21b2a3bdedd69dc1

SHA512
4ab66c30d3b245fd4e2cf1df5fe1ad4583066393b5f2b516064a89fe7dc6556b28e34fee8e9768d30ccdc4f70ea94b09a1e4b1f39644db1162a6614331b1ce2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
215KB

MD5
d79b35ccf8e6af6714eb612714349097

SHA1
eb3ccc9ed29830df42f3fd129951cb8b791aaf98

SHA256
c8459799169b81fdab64d028a9ebb058ea2d0ad5feb33a11f6a45a54a5ccc365

SHA512
f4be1c1e192a700139d7cff5059af81c0234ed5f032796036a1a4879b032ce4eedd16a121bbf776f17bc84a0012846f467ad48b46db4008841c25b779c7d8f5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
1024KB

MD5
e39e3cff00f4145fe21c2d56f5b9d4d5

SHA1
224141fee13d4117d7769f0d0641b2bdf53b90ba

SHA256
8d81c62c0b07e13e9f195fb1c12fe62fc27174674d86be5a2d26a74b48003c12

SHA512
7014cd51425821d98ea17886ea2a5a9c669a04211182e46b04a3f15105629daa04473f9826d34d9a753799ad223b4f71f600fbeb49bd82f1ba13ebff311438c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
cf4833bc02da0a4522a6eb731eca2a45

SHA1
73b897f2402a2194a4f2cb657f2b6566a683bbdb

SHA256
964fc51e4903d64090913f8c72a0dac05467ee01e1198c29d1151b0ff331afa0

SHA512
037f4c55f01b4677c6264275b6d068ef9d0abf12b8ea3e56187b7fc9d740497a9940e0de18501bf36ad7beb2ecb07b2adb287f48d9dbb30b6409cfd2cc8b3c29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
936B

MD5
aa2e5b60627bba822c61aa12b1e43df8

SHA1
9113c9b1c6eb10d48879e7e1a1d9bece2dd5a7de

SHA256
3780a0c51bac2594b5e9608329abc9f2bbf71c098abca40ad0927d64bf94a9d7

SHA512
1e1eb7f0cb39e2af14d0722c5d3dfb73884e1b7d0e8a644cd8a4047452192f70958fb7c313cfc6217d133710c8763c5b50d251fbe36fa1b8bcc5a587fd54af52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
c52e84b8fa4e923bbede3a22d914c526

SHA1
b71643ceee2ce8767c852d8533cb6a3e353ec091

SHA256
79689a49f64296c57bc6204d6b80a05bd3f6cc5f5542165606ebe7114ade857d

SHA512
3773305714d98b5c9a8a5019ecde7ab7d4dc90b4cd16567d9cf63b8f847db4d36f07a6bf21c79ca520c4b1fdba4c71140318ce43812c1cdaf7d41f818a7be687

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
834a5cea234a02d50d0a2b09ef76c923

SHA1
695a8da588eefe4e92f45cd7b41cd3f123f99a59

SHA256
99da46c10d7f9a683a307a86365dfbde0ec85427a436e1e516aafec62749b1e9

SHA512
1e69f08fc0f9b2bd8888541b03a8b8ad486e0c8c51f0e6d02fdf701546a8e0c303ce064178b6965485e8ccd400c560f7bfa016ae0850ae00170c3412dd602779

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5f4e34d414bb592258f89f7939b09c6e

SHA1
8694bdab9648c4953056df6819ca6918e6935967

SHA256
2880f5a4c1f5fc1c5c82a298ae3ff5996dce53007d845bffa0ee2e4ee631e926

SHA512
1065fdc835d23639212c8804ed72fb0003a31174955f97821bef4099c2b2505594c62238259a8a0cb8ed7b8b50bba95cb44ff17893b44ae99f780328b27d0ecf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
39e3ca643dd9159aa8c9853403a44afc

SHA1
790635808ad2b26f3cf2aa1697bd19ae81572f7b

SHA256
b2aaf17b3e259f57cb31146056d6436a0dbc279ceea113ed1ff9edc2a55e3db8

SHA512
0b648ffe0efb0d80ee55ed7d8ae4c6a4ed1e3a3173449a31e9397df3326e6429f3f209359db6d68b941c929fab69343c3282aea4e9458928ce86409ed502419c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6acae239ec259817f36d3b52b68b233f

SHA1
2daef427dad1aefd81f676f835f100326146b736

SHA256
4fff42c9f96775c1ce0b0d251c199e0e22c4fa89b62486469987f0a6153ca4f8

SHA512
c47a050b2c0b5da5688a9e0b004669894905855ca87d19a4e84c3204cad05c30df8a56095fe09bbe5cbee1a8871f59d7bdf17e4b4b16c5d05ed4852735ba0f7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
fc12dfaffcf33475f29bd795ca58aa83

SHA1
6f0caa0135c48a6fdbb81f52ea3fa094e5186356

SHA256
3da65185fc8e6c48d1c10c86e0470e2588b5050443d43a48000b10ae67871f1d

SHA512
a64b7f0580d85a2172fe802b8356c7c212f2f0b488a4e454c0aebaf001d6b2fc06b954677cb05f645c702f726c1a0ea08e0485541b706ed0c447caf207ff5245

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d73c869a453013478ccd905ac2f1d9c6

SHA1
befe1894ba8104a5930d8c7a6648274341a8b1b2

SHA256
156e067c9e15dbc0297af1c970f2d6d92b6a37f18296db3e48ed0d28787fa877

SHA512
48daa235aa733af5413647d82ca4ab17ab58a0cedbc1686ec83d63121387f675fec330e4bbe1fb60ece9b45862ef38ba33bac902e73f0499bd03c2c4ec64c361

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0ede2745e3327970562670e7976d3755

SHA1
bfa23c9c3e5841372494dde1cdf736888ff1c8fd

SHA256
8b9a7db947685dd32c95b8b6477a2606a4614afc4a2ff9a59c472df38a6149b1

SHA512
666968bdfa2f7110b72dcc4f2f195ab91f0157636a337d7443cba2bea9ddc9187621c74042fa1df1d2c49cb90a59c90a54fd3a3e955add5211cbac052be3c3b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
610c31bebd6ceb8ac7ad89ce19b91f8e

SHA1
e3fde41d5d20a0c53d05bcd7c7b6c9df68fe42a2

SHA256
35c48c237e7695117ef66aff669a6d363f7c6f4d62f51d9ecfa1a036ae69b765

SHA512
3d0548f41b32fa2876a631b8bc3e9a4bb1f9f82fdb0f4ff3233b58de0179319b396cf396937c11f8c20185a88bb47814af4559b625be54707ec6f359a269c570

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c4774362c7cb7d88e3a9af995552016b

SHA1
1ed399183a85c587af19b6dd82b7991b870424ed

SHA256
e87cac3a419eb25e08d34adde1ba23618616f14d857d28fbae01af0ea1aeb793

SHA512
bf140815e6f387677f0932da0278eb1b89103d8b27dd76e116a75dcd525cffa39954df732dc7f4df5c142552d502770e88ad00e24305d1f519a967682432cf4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b363b8fdc07a11faede68eccfd3b9824

SHA1
23a3df7305ccbaec5caaff193ce4421ab350e875

SHA256
79c2cf9ace499f5c4ab644f79ac054d857ffa38f0cc106eea500665c9f9949a2

SHA512
1500dd73fd4e39968f74d55aa05e23bc8a0d1576280695d2a1de2d72f7ef1f6727183808467a9e2d23e9fa39021e9b00d196b8a14d28a97df8fd4596a7a23140

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
52438527c16de4823622d6b646c78a8c

SHA1
67d4db2046c9418d4adf7aebc0cc3f8846456b9c

SHA256
c540562f33056c7a9e16f2263d82eec899e7227ac25fb944565edb9357323866

SHA512
c589467368a2d75321d7e169b80058997ce294aec7f8cea2be26fa4ad61622279b1dc2bc926de9fd4b1bd50b3055540d0775083379022304ff2dc14fd30181b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58343a.TMP

Filesize
872B

MD5
76d7d0005825bb2e7693428f016315c9

SHA1
465db1a1fa191461477f0f7e040fa517234570e5

SHA256
ef184cec11f9abf47a8cb66d5e27c9c7967587ffdac76c4512668adc66e4b060

SHA512
6666e9bdaabef2742bf66b7686e8660ded1996d8a480aa1e6521d942b69edc23cd2e9aa34a26099c363e9c5b26aad1f95468d5821eef0fa26e450a66fee98c6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
25628fe9b7239793c0ca75b61bb4b90c

SHA1
e233aa04b7a580e37c3adbae073bc913f3126940

SHA256
ca81eb48d3a94c33f349283ebf3e835c0b0e75a9d7aef65a0bc5b4123bbff727

SHA512
18826165854362826ec4fc363a1bb1d40daca8635884871ef34807c57c3cec1d4967716b8e93eb0fc3d681b4585d25d2ed8db8a74feb11fa55b302c3029e6bb5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit