31b50bf84e4920eba936c321dd56086506b1ad115bbf50862690ffb9fe0c5e21

Resubmissions

28/03/2025, 16:53

250328-vdy32aywfw 3

28/03/2025, 16:30

250328-tz1cjszqv3 7

28/03/2025, 16:27

250328-tyb9bsythv 4

28/03/2025, 16:19

250328-tszsfazpw8 5

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2025, 16:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GNBQY-997049.pdf
Size

9KB
MD5

036a6b0818e38574dc32f192be0756db
SHA1

3e9a6c7056cd4a1d3c2a2e897b0880f012b85e29
SHA256

31b50bf84e4920eba936c321dd56086506b1ad115bbf50862690ffb9fe0c5e21
SHA512

7461f3e20417a72afcb66b3574e48bcabfe9acc0fc8f79e7233788168dc65da2b617f19593ced669091656c8793aa6ffa7c9ba8c0d587be1cb03de50c53bdf29
SSDEEP

192:826ESYK7DzfYzETR8wlk2w1ic84kOHHrDYDIlYDIvJoYDIYr:826ESY6DzAYTmwe2w1n8DqYDIlYDIvJr

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3820_59728092\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3820_59728092\_locales\ko\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3820_59728092\_locales\hu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3820_59728092\_locales\gl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3820_59728092\_locales\it\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3820_59728092\_locales\am\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3820_59728092\_locales\es\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3820_59728092\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3820_59728092\_locales\ro\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3820_59728092\_locales\tr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3820_59728092\_locales\be\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3820_59728092\_locales\cy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1892_1284147279\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3820_59728092\service_worker_bin_prod.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3820_59728092\_locales\fi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3820_59728092\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3820_59728092\_locales\en_US\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3820_59728092\_locales\si\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3820_59728092\_locales\en_GB\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3820_59728092\_locales\sl\messages.json	msedge.exe
File created	C:\Program Files\msedge_url_fetcher_3820_554518436\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_90_1_0.crx	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3820_59728092\offscreendocument_main.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3820_59728092\_locales\no\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3820_59728092\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3820_59728092\_locales\lv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3820_59728092\_locales\de\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3820_59728092\_locales\lo\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3820_59728092\_locales\zu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3820_59728092\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3820_59728092\_locales\hi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3820_59728092\_locales\pa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3820_59728092\_locales\sw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3820_59728092\_locales\hy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1892_1284147279\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1892_1284147279\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3820_59728092\_locales\bn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3820_59728092\_locales\en_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3820_59728092\_locales\is\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3820_59728092\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3820_59728092\_locales\sr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3820_59728092\_locales\cs\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3820_59728092\_locales\et\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3820_59728092\_locales\ne\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3820_59728092\128.png	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3820_59728092\dasherSettingSchema.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3820_59728092\_locales\af\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3820_59728092\_locales\my\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3820_59728092\_locales\eu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3820_59728092\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3820_59728092\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3820_59728092\_locales\mn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3820_59728092\_locales\vi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3820_59728092\_locales\pl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3820_59728092\_locales\te\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3820_59728092\_locales\ml\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3820_59728092\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3820_59728092\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3820_59728092\_locales\kn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3820_59728092\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3820_59728092\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3820_59728092\_locales\ta\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3820_59728092\_locales\fil\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3820_59728092\_locales\ur\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3820_59728092\_locales\en\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133876529020601104"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 24 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	AcroRd32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	AcroRd32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	AcroRd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	AcroRd32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Documents"	AcroRd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	AcroRd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	AcroRd32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 14002e80922b16d365937a46956b92703aca08af0000	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	AcroRd32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff	AcroRd32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\NodeSlot = "3"	AcroRd32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = ffffffff	AcroRd32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-308834014-1004923324-1191300197-1000\{CD634348-7EF6-4AFC-A0DE-9790E295458A}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-308834014-1004923324-1191300197-1000\{E4C6BBD8-14A6-4C4A-8D5E-EFE4C26CA0CF}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-308834014-1004923324-1191300197-1000\{673BC58E-186B-41FF-989E-039B968EA728}	msedge.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
3772	AcroRd32.exe
3772	AcroRd32.exe
3772	AcroRd32.exe
3772	AcroRd32.exe
3772	AcroRd32.exe
3772	AcroRd32.exe
3772	AcroRd32.exe
3772	AcroRd32.exe
3772	AcroRd32.exe
3772	AcroRd32.exe
3772	AcroRd32.exe
3772	AcroRd32.exe
3772	AcroRd32.exe
3772	AcroRd32.exe
3772	AcroRd32.exe
3772	AcroRd32.exe
3772	AcroRd32.exe
3772	AcroRd32.exe
3772	AcroRd32.exe
3772	AcroRd32.exe
1892	msedge.exe
1892	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
5428	msedge.exe
5428	msedge.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
3772	AcroRd32.exe
3820	msedge.exe
3820	msedge.exe
5428	msedge.exe
5428	msedge.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
3772	AcroRd32.exe
3772	AcroRd32.exe
3772	AcroRd32.exe
3772	AcroRd32.exe
3772	AcroRd32.exe
3772	AcroRd32.exe
3772	AcroRd32.exe
3772	AcroRd32.exe
3772	AcroRd32.exe
3772	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3772 wrote to memory of 5644	3772	AcroRd32.exe	93
PID 3772 wrote to memory of 5644	3772	AcroRd32.exe	93
PID 3772 wrote to memory of 5644	3772	AcroRd32.exe	93
PID 5644 wrote to memory of 4804	5644	RdrCEF.exe	94
PID 5644 wrote to memory of 4804	5644	RdrCEF.exe	94
PID 5644 wrote to memory of 4804	5644	RdrCEF.exe	94
PID 5644 wrote to memory of 4804	5644	RdrCEF.exe	94
PID 5644 wrote to memory of 4804	5644	RdrCEF.exe	94
PID 5644 wrote to memory of 4804	5644	RdrCEF.exe	94
PID 5644 wrote to memory of 4804	5644	RdrCEF.exe	94
PID 5644 wrote to memory of 4804	5644	RdrCEF.exe	94
PID 5644 wrote to memory of 4804	5644	RdrCEF.exe	94
PID 5644 wrote to memory of 4804	5644	RdrCEF.exe	94
PID 5644 wrote to memory of 4804	5644	RdrCEF.exe	94
PID 5644 wrote to memory of 4804	5644	RdrCEF.exe	94
PID 5644 wrote to memory of 4804	5644	RdrCEF.exe	94
PID 5644 wrote to memory of 4804	5644	RdrCEF.exe	94
PID 5644 wrote to memory of 4804	5644	RdrCEF.exe	94
PID 5644 wrote to memory of 4804	5644	RdrCEF.exe	94
PID 5644 wrote to memory of 4804	5644	RdrCEF.exe	94
PID 5644 wrote to memory of 4804	5644	RdrCEF.exe	94
PID 5644 wrote to memory of 4804	5644	RdrCEF.exe	94
PID 5644 wrote to memory of 4804	5644	RdrCEF.exe	94
PID 5644 wrote to memory of 4804	5644	RdrCEF.exe	94
PID 5644 wrote to memory of 4804	5644	RdrCEF.exe	94
PID 5644 wrote to memory of 4804	5644	RdrCEF.exe	94
PID 5644 wrote to memory of 4804	5644	RdrCEF.exe	94
PID 5644 wrote to memory of 4804	5644	RdrCEF.exe	94
PID 5644 wrote to memory of 4804	5644	RdrCEF.exe	94
PID 5644 wrote to memory of 4804	5644	RdrCEF.exe	94
PID 5644 wrote to memory of 4804	5644	RdrCEF.exe	94
PID 5644 wrote to memory of 4804	5644	RdrCEF.exe	94
PID 5644 wrote to memory of 4804	5644	RdrCEF.exe	94
PID 5644 wrote to memory of 4804	5644	RdrCEF.exe	94
PID 5644 wrote to memory of 4804	5644	RdrCEF.exe	94
PID 5644 wrote to memory of 4804	5644	RdrCEF.exe	94
PID 5644 wrote to memory of 4804	5644	RdrCEF.exe	94
PID 5644 wrote to memory of 4804	5644	RdrCEF.exe	94
PID 5644 wrote to memory of 4804	5644	RdrCEF.exe	94
PID 5644 wrote to memory of 4804	5644	RdrCEF.exe	94
PID 5644 wrote to memory of 4804	5644	RdrCEF.exe	94
PID 5644 wrote to memory of 4804	5644	RdrCEF.exe	94
PID 5644 wrote to memory of 4804	5644	RdrCEF.exe	94
PID 5644 wrote to memory of 4804	5644	RdrCEF.exe	94
PID 5644 wrote to memory of 5024	5644	RdrCEF.exe	95
PID 5644 wrote to memory of 5024	5644	RdrCEF.exe	95
PID 5644 wrote to memory of 5024	5644	RdrCEF.exe	95
PID 5644 wrote to memory of 5024	5644	RdrCEF.exe	95
PID 5644 wrote to memory of 5024	5644	RdrCEF.exe	95
PID 5644 wrote to memory of 5024	5644	RdrCEF.exe	95
PID 5644 wrote to memory of 5024	5644	RdrCEF.exe	95
PID 5644 wrote to memory of 5024	5644	RdrCEF.exe	95
PID 5644 wrote to memory of 5024	5644	RdrCEF.exe	95
PID 5644 wrote to memory of 5024	5644	RdrCEF.exe	95
PID 5644 wrote to memory of 5024	5644	RdrCEF.exe	95
PID 5644 wrote to memory of 5024	5644	RdrCEF.exe	95
PID 5644 wrote to memory of 5024	5644	RdrCEF.exe	95
PID 5644 wrote to memory of 5024	5644	RdrCEF.exe	95
PID 5644 wrote to memory of 5024	5644	RdrCEF.exe	95
PID 5644 wrote to memory of 5024	5644	RdrCEF.exe	95
PID 5644 wrote to memory of 5024	5644	RdrCEF.exe	95
PID 5644 wrote to memory of 5024	5644	RdrCEF.exe	95
PID 5644 wrote to memory of 5024	5644	RdrCEF.exe	95
PID 5644 wrote to memory of 5024	5644	RdrCEF.exe	95

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\GNBQY-997049.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3772
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5644
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=FF052F1645A446CA6B0105FB3AE776F5 --mojo-platform-channel-handle=1732 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4804
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=B22C5E50B9D86779A81DD3F0ED6F24A2 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=B22C5E50B9D86779A81DD3F0ED6F24A2 --renderer-client-id=2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5024
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=DB1B1B2925A84E94E05E3E4261D511FC --mojo-platform-channel-handle=2268 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1596
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F4C7823A2130B7C7B5362CEABCA44D82 --mojo-platform-channel-handle=1916 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5068
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B087936212EA4AF9984360EA4CFB72FD --mojo-platform-channel-handle=2360 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1448
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=6D89C5F6A51D514176BCCAE9FA4EC7C8 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=6D89C5F6A51D514176BCCAE9FA4EC7C8 --renderer-client-id=8 --mojo-platform-channel-handle=2324 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2604
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=1C97DEBA0E0C404D0BDB7B0ACA3B862C --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=1C97DEBA0E0C404D0BDB7B0ACA3B862C --renderer-client-id=10 --mojo-platform-channel-handle=1316 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://226.187.202.64.host.secureserver.net/tAneFb12GT1OnaBLPYvi
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  PID:3820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x2f4,0x7ffd9bf9f208,0x7ffd9bf9f214,0x7ffd9bf9f220
    3⤵
    PID:968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1772,i,10658512295743207071,7673404202448204714,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:3
    3⤵
    PID:880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2320,i,10658512295743207071,7673404202448204714,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:2
    3⤵
    PID:1048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2620,i,10658512295743207071,7673404202448204714,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:8
    3⤵
    PID:4416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3560,i,10658512295743207071,7673404202448204714,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
    3⤵
    PID:4632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3588,i,10658512295743207071,7673404202448204714,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
    3⤵
    PID:4564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4908,i,10658512295743207071,7673404202448204714,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:8
    3⤵
    PID:5564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4912,i,10658512295743207071,7673404202448204714,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
    3⤵
    PID:1240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5476,i,10658512295743207071,7673404202448204714,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:8
    3⤵
    PID:3268
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5784,i,10658512295743207071,7673404202448204714,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:8
    3⤵
    PID:464
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5784,i,10658512295743207071,7673404202448204714,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:8
    3⤵
    PID:656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6040,i,10658512295743207071,7673404202448204714,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:8
    3⤵
    PID:1984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6060,i,10658512295743207071,7673404202448204714,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:8
    3⤵
    PID:4432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6076,i,10658512295743207071,7673404202448204714,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:8
    3⤵
    PID:2352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=6252,i,10658512295743207071,7673404202448204714,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:1
    3⤵
    PID:4316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:5428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ffd9bf9f208,0x7ffd9bf9f214,0x7ffd9bf9f220
      4⤵
      PID:4348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1788,i,4183505382736012572,1359143955633426631,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:3
      4⤵
      PID:5008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2208,i,4183505382736012572,1359143955633426631,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:2
      4⤵
      PID:4748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2588,i,4183505382736012572,1359143955633426631,262144 --variations-seed-version --mojo-platform-channel-handle=2720 /prefetch:8
      4⤵
      PID:644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4236,i,4183505382736012572,1359143955633426631,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:8
      4⤵
      PID:2296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4236,i,4183505382736012572,1359143955633426631,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:8
      4⤵
      PID:5036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4652,i,4183505382736012572,1359143955633426631,262144 --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:8
      4⤵
      PID:3668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=4848,i,4183505382736012572,1359143955633426631,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:1
      4⤵
      PID:860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4856,i,4183505382736012572,1359143955633426631,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:1
      4⤵
      PID:3480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5416,i,4183505382736012572,1359143955633426631,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:8
      4⤵
      PID:1992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5452,i,4183505382736012572,1359143955633426631,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:8
      4⤵
      PID:5796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      Drops file in Program Files directory
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      PID:1892
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffd9bf9f208,0x7ffd9bf9f214,0x7ffd9bf9f220
        5⤵
        
        PID:1940
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1772,i,611191546539032508,6795333203249340979,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:3
        5⤵
        
        PID:964
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2140,i,611191546539032508,6795333203249340979,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:2
        5⤵
        
        PID:2184
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2544,i,611191546539032508,6795333203249340979,262144 --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:8
        5⤵
        
        PID:5876
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4368,i,611191546539032508,6795333203249340979,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:8
        5⤵
        
        PID:5812
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4576,i,611191546539032508,6795333203249340979,262144 --variations-seed-version --mojo-platform-channel-handle=4600 /prefetch:8
        5⤵
        
        PID:4396
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4576,i,611191546539032508,6795333203249340979,262144 --variations-seed-version --mojo-platform-channel-handle=4600 /prefetch:8
        5⤵
        
        PID:4988
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=564,i,611191546539032508,6795333203249340979,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:8
        5⤵
        
        PID:3880
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4764,i,611191546539032508,6795333203249340979,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:8
        5⤵
        
        PID:5248
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4756,i,611191546539032508,6795333203249340979,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:8
        5⤵
        
        PID:4516
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4508,i,611191546539032508,6795333203249340979,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:8
        5⤵
        
        PID:5280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://226.187.202.64.host.secureserver.net/tAneFb12GT1OnaBLPYvi
  2⤵
  PID:1940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1916

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5396

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:1572

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5404

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:4316

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:220

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping1892_1284147279\manifest.fingerprint

Filesize
66B

MD5
496b05677135db1c74d82f948538c21c

SHA1
e736e675ca5195b5fc16e59fb7de582437fb9f9a

SHA256
df55a9464ee22a0f860c0f3b4a75ec62471d37b4d8cb7a0e460eef98cb83ebe7

SHA512
8bd1b683e24a8c8c03b0bc041288296448f799a6f431bacbd62cb33e621672991141c7151d9424ad60ab65a7a6a30298243b8b71d281f9e99b8abb79fe16bd3c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping1892_1284147279\manifest.json

Filesize
134B

MD5
049c307f30407da557545d34db8ced16

SHA1
f10b86ebfe8d30d0dc36210939ca7fa7a819d494

SHA256
c36944790c4a1fa2f2acec5f7809a4d6689ecb7fb3b2f19c831c9adb4e17fc54

SHA512
14f04e768956bdd9634f6a172104f2b630e2eeada2f73b9a249be2ec707f4a47ff60f2f700005ca95addd838db9438ad560e5136a10ed32df1d304d65f445780

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
36KB

MD5
b30d3becc8731792523d599d949e63f5

SHA1
19350257e42d7aee17fb3bf139a9d3adb330fad4

SHA256
b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

SHA512
523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
56KB

MD5
752a1f26b18748311b691c7d8fc20633

SHA1
c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

SHA256
111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

SHA512
a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
ffbb8ac63f91577ffda372e216533fb7

SHA1
f4b23f50e8fff9f3e307564f874dcf95982a2fb3

SHA256
fe8f0128c4ff3ae6ee6b310c9b9d679b766ff0454d7b15ad1bffeffdebf80bfe

SHA512
13671a5db4cf7cf0a2c664c069d4dbf40aa7a736186a4f346e7cca59d35a47b7df5e78b16ec54ce93cd7f849021dcacaf0f27b0b9943c5fa7b1780612e00e0f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.9\protocols.json

Filesize
3KB

MD5
f9fd82b572ef4ce41a3d1075acc52d22

SHA1
fdded5eef95391be440cc15f84ded0480c0141e3

SHA256
5f21978e992a53ebd9c138cb5391c481def7769e3525c586a8a94f276b3cd8d6

SHA512
17084cc74462310a608355fbeafa8b51f295fb5fd067dfc641e752e69b1ee4ffba0e9eafa263aab67daab780b9b6be370dd3b54dd4ba8426ab499e50ff5c7339

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma

Filesize
16KB

MD5
cfab81b800edabacbf6cb61aa78d5258

SHA1
2730d4da1be7238d701dc84eb708a064b8d1cf27

SHA256
452a5479b9a2e03612576c30d30e6f51f51274cd30ef576ea1e71d20c657376f

SHA512
ec188b0ee4d3daabc26799b34ee471bee988bdd7ceb011ed7df3d4cf26f98932bbbb4b70dc2b7fd4df9a3981b3ce22f4b5be4a0db97514d526e521575efb2ec6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
01cc3a42395638ce669dd0d7aba1f929

SHA1
89aa0871fa8e25b55823dd0db9a028ef46dfbdd8

SHA256
d0c6ee43e769188d8a32f782b44cb00052099222be21cbe8bf119469c6612dee

SHA512
d3b88e797333416a4bc6c7f7e224ba68362706747e191a1cd8846a080329473b8f1bfebee5e3fe21faa4d24c8a7683041705e995777714330316e9b563d38e41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
b3607049da2a494013ac244be66afa64

SHA1
a7f44af6b91cf0c93e8be313abf397dd070269ab

SHA256
68cb39c643a89b5717664b43ef2053c73278e5919130804fb0420289c9ce6fa2

SHA512
08f2e4063a45e2a6affa2e36222c2e3fd672c52f062cde82e7d7c7c4a841dc35f034a402b6c76fb3bef24beffe846282e683f67e3f99ba8ead2d83c3a23f5f3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
138d8a87cb306f86459d17fa991c5843

SHA1
3cf2380fe1ba7547b11e8a4c3ee3bff27d23d355

SHA256
7d98177f9b5fee9c6f21bbfeb4c9842ad5c8255f0d9523ce57679429323ca7bb

SHA512
8e1f7cc58390c1bbd8222da680830716555316bd95a2ede00ca8ba11c3de9dea609e5c28dbca172985db80d07846ca10ec5030a87869071c71122e1838e590d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0

Filesize
44KB

MD5
c32cce35dd5b9981eb2e52636008eeab

SHA1
b92c2e2fb4d391905a3d8edd317b8a0bc02c221a

SHA256
e879db871e332771d9ea3c1af7fc6940301fb2a380f3952870274aac7dff39d2

SHA512
9752f89ef133f0e1caab5f48d808caffdb6ef8ac399f0cbe28bd62a1a4a41de1d2680a195d1db8196645f9bac85afeaa3288f289f5420a70444c8b2c6a69bf03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1

Filesize
264KB

MD5
ceb219719f5709aa18ba815be7f74276

SHA1
07890892367a975bce81fe53f4eb11bdfcdd88d1

SHA256
698d5fb10fe3ceebd45ee38e3f176e806fedc18730daa8886b79a54b48a13d3f

SHA512
c4f7f73e39ed10ca05d45ec52efee57e977b8f2fd5f194429691f519ff66c2749d4cfc612b3c1c8f079e6be477bfd7778827faef1ec80990460390beaa59a6ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2

Filesize
1.0MB

MD5
f6179202c0feb6aeadae0dab0a10d45c

SHA1
e778e195299c9ec62cb083f4f6dfca118315cc70

SHA256
16f627d49446468c153902844dbe542d706a85c9a2fb828ef1de31ca9d44b053

SHA512
712861722ef93c5e44463f4d2eaeeed61badd3f5a5f050ceb7bdd4de5b13616273d62400ce7f1ac9d0c6f4e61ef332c2108ea447a7ffd87600b35eeec4522cc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3

Filesize
8.0MB

MD5
92fb92255c887c771882ce5e582359f0

SHA1
3bca43d6bb76ef8573534e7aa8e2e7528c831aad

SHA256
12c8a934012ee152079f74fad28fe83e2f59f25fc3a327a1fe45f646a4f5629f

SHA512
49707669d23bcaed6f5aea979dd7876b7b96ae3b7297eb0fe4784b88cf76bde06aee608e4d44e23d88b50ffe8b63704595efe1a628170bea01e7ca6098dd7883

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000076

Filesize
19KB

MD5
5e5ae2374ea57ea153558afd1c2c1372

SHA1
c1bef73c5b67c8866a607e3b8912ffa532d85ccc

SHA256
1ef458d087e95119808d5e5fecbc9604d7805ea4da98170e2c995e967da308f3

SHA512
46059e4a334e0a5295ebcef8401eb94b8fa0971b200f0f9e788ed61edae5018c917efd30b01631cbd6bdadc5240c9fcad2966ea0aa9c94b538bcc369e10bbbaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
94ba9f1dfcbb1f7533e346b50604040a

SHA1
d4ee4ad9c9cf49b3de57843da0c87a46ffe98104

SHA256
87e80631f47327f64d2c1fad147ef35df349ec1d6c4415b443bb96ad6458a21f

SHA512
88f7d4a6ff088b09b8f3595b745894cdd6264e12d1d9d89cb8c55f7e0d02544374d39bd4aedec7ac763cf59cd5540a0595533cd491b01a50839fe03633e31de2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Filesize
346B

MD5
21146994b329854fdc71d1caeb80135a

SHA1
1daad7b993c65f4f66c211701dffe2eaf46f58b9

SHA256
efaba6000c3df8ae6f4ebe98717d61ec0580a878fb4de57e557bfddde1d1b2f6

SHA512
61e19907e92ef7a8a0eaf4bbe7f8a545a66813046af4717602f14fe66066938e13f7038e6687b2d7aad655291ce7a8cb505167af2df79d7049724f04f58917e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Filesize
32KB

MD5
b1d30f1454b60706829fc2159ad861a2

SHA1
0adfbfd7ceee606775eb4329a94f01b0d76ed391

SHA256
edb4ebb9e5aa87f529114b2fcc7c0fcadb785547bba7371a8b2e26bb19becdcf

SHA512
bee09a9e022da8510e66044ae48c25f89cfaffdd94a778f171f0b64e858d8b7cb88960f420abfa375438f4c25abe6c352a16359c808f18ea25aa003674e7cd66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Filesize
456B

MD5
f23d2df21a39aa8d814cade6c37856c8

SHA1
233e65707015a53f83a0d53db03a4af8fab21ea6

SHA256
c5ce9aaf8ffdcb8a00463a7bf24001885e0a792f110c8db74a1e2f4392cb0e31

SHA512
a7b50b8cafba80f6baca44b260f8379852c4176f3dd57168812f3b4b811d2ff340f09f8ce625cc2adecab2851cc33725cb729548a3da98b041387c7952077918

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Filesize
322B

MD5
42b78fbed00e279fd7eb78bb54984923

SHA1
99611d7985e5ec17c0b66b063e080afc796e77d2

SHA256
d168696164a43382f418baefea19c4433c21ac07df1eba4f0c933a6be6056d5e

SHA512
ace043d2ebb7ca67ad0f69d1a8cafc82f303a2524ce72700b98b9a41c59916803eb17bfc5ddeb481e1a12991b534fe22f35292e0c7e2875935e6abd7e717051f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
192KB

MD5
9507bf5b207c69c8d706851929cd0ca4

SHA1
4dd6f8136d12bad8d2fd58a0a121824fa6d007c0

SHA256
ab272424841397c494fcfbe3ceec59b5e56bdb5c99b2b2abea3ac2d4d3dc9999

SHA512
de985f175a4ddc50fcba2da09f0e64bebddf375467b55acecc06104ba535bb617e5e49a8dcd7481266e212987265799ee159ac7a3b4144aaaa9c7b243618a14f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
331B

MD5
9051cd140cc45905a9a45b634b183f55

SHA1
1036be32a98cacef9799a90c3e5d6c0c3ac7d669

SHA256
eea7d737aa1fbd2cfaee6371d3296f1a234d0ff3cd1a7b1fbdb853ec395d5ce0

SHA512
0c77760d0477ffd6586a7f076194781aa27129958c77bc027ea20ec599c55ddc7eb3d8b6d4d02553b144fdc50d42136c1af06850a3e8dcbc407357953b70b0c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
309833bbe41e408d77058c85850c7d43

SHA1
c4e7c70b531fbe4b5e9631681062de6fe7098692

SHA256
68666a4e116c2323b33636f77b737b869f0150b6142cdac67909fd80c4dc5251

SHA512
060f0a96fbf5a5fea01b8a69a31f9256bf1140128473c183d9078ce32a6ed2d1a547d3114943025aca4e4d3c1aed51dc96da3b031034397462bdfd0e1fa916b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
69875d8caf268203525e2e918a90c11c

SHA1
6df0180e7d45a973f13f446f825520c21b38a2df

SHA256
f15821d2df8019597475417f3f481d34d6d12b12b8c0e958caff9bfe022efae6

SHA512
533c5ad7c2f86adb760fe74854073904dc989e4142e05ac347a53cebdc62503b90bc245f0bbd1e677ddca9eca322acc7c003b4df0821f31d7116bf7b14e56866

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
956b8cbba3993d6e53b558b02f45daee

SHA1
05ab42974ef09cae40cab2bd3360cb54c3edac3d

SHA256
f9b7b55a5b536f92eee922cbc21ef752b27446cd61712e9bce93b4c7c2ea7cf7

SHA512
d655a665ab22811078177418a144742be3bf08bfdce9308958a0023e968c05cc2b26b27fa6e7367d68028d0e2bf05d508a077802f259914c7bda2a8a495d931d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
3c0716e6ac671ac5310e0a70fcdb53bf

SHA1
aefdb3bf0087cec6be6c291be7bbbbad544d8e28

SHA256
5dd1188f16d68f568a512a1fd0ec902344105de9c71b6c75de218901b19c3e4b

SHA512
ef05031bf27b5f526e1e5e747ff43e2a33fa5c28c6de8246083a8925b088cdc632db68a6f3b8484221ad816340e746ae6a4776c64dd9f6c44128a8e59bc5fcac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
cdb38d8032fbe02d415c37bfb9cd717f

SHA1
45a421a55d3a6aa4b650a39ccd0d3df88a76e658

SHA256
44a4361c5271f29efbcf341d3f96a8a79021736e28ea45d42e27e4876b48f798

SHA512
ab0fbc63b540d46297802c7d106cd845f024d4186d78cb92014a84320ff8877ff247ccd383ccfc896c68521b7c253325f757cfff928754bed67cd35a77c54055

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
f3d431fde03afcfd78eda6c692450427

SHA1
b7620ed93f8fd05ba330bf8664e30d60c37c4fff

SHA256
9ffeb175fd95fc8d5df1ed3adad5dd9665ea88ab08d7e185a0240310133154ab

SHA512
5247e943f91dc4568da6b900d2d9813920e776c48c298bf20183c7762c306325a9afb428cb91ba5d7ba52a13f2a8515847ad12eda3de0753c6d6a6f07286c638

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
531dba81831a1e599e63b1496809b19f

SHA1
250781934ef0ed9a0b446f64b7b9103b119f8fff

SHA256
3316f0607108e0ad2eec39dbbc4e0c248fa7f6dddb3c2ed2d6637dfd33bad6eb

SHA512
79275045c634b064f8b3bc2846b8528a873a77e3209bea0724906c51d7e0b3cd1b4aac4389be318e7c0119a57d6ed27646414bed6ca0d37caf4996d73fe4a9f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
c4fa0161d0ef309b49c975c36fe48da1

SHA1
4bd7106c39372b0d0e6b352a4c578fd1c77f9c67

SHA256
f8933889cd61e4a0c2146cfec79e757239278a212ea9c0e6d220e4ae90d6ceac

SHA512
d12fad62b1b9aab29bde43e75ed6db1da8deae71cdc1ba08d2540878920a63d81a6df403d8a0a7c4e213c7ace7a6d7857d74622fd58c92ce8b50d0119914071d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Filesize
335B

MD5
adb83987a8cb1f4630279fa54b7b28df

SHA1
09217f50bf9e06cbc076326f7e7890dda7825769

SHA256
6467fbd0911499854f23c7fc77ff0745df78f9b52743aa4e6a23099f055d9d90

SHA512
aab2bdb0a8a92995ac2b02f6e00e4d903fa741c5fe89afe52d56bea221ff14001619d838926bbb46681f1c5a907168d9787a3d0d21e74c7d6b77b31b8c30b6c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
350B

MD5
470cdd6b1c65fd3dfbb598d6cd2c3d6e

SHA1
557d745071ae15244f352ccb727fed9da0590bae

SHA256
05ccb5a6ca827613d9d6b55afb6365eb2bcbe7abe8a3f940eac9246522cc1d41

SHA512
6a397e6179aea849056ea3824ba152b0d4f3547eef2c48c9610e538771fd77b566500458ab99077b2f485592445ee054c9580a763f17b95f57abd308db38be95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
e7bb4a2f56c2374a406b74bc75b6611d

SHA1
ad6958fac549f527398c9de2bfc0d32941eafb0d

SHA256
fcb1b89467853fa5f46ffaee80ace60a3b51eb928a0e80a6cc94ff50bff38906

SHA512
cc583e88be4aaa683e2b499bd4267d2d932546daf757a2105e9c0700263be3ac2851e95e64089382a53972369360cae6d972bb2e67fec895efb1f76df1e8ee5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
27a10784760bb7f9444b14a2b9ec1027

SHA1
fa5e7b61a083fb4e0b847a712dced97000df2b3c

SHA256
2c4a69351aa1a37b51829cfe4a807d9b097cb615b3b31590b5e7b4675bff54bf

SHA512
cab47928f742304a08599d078859158c9ba6707474be7e22f47127a5302ff5976676764c3f2296e830fb366ff3afb451bd91cd0abe17fb59f4d82432d9989eab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
25KB

MD5
1ac00bce73034bb88805030b5626d9e3

SHA1
ab2639ef982e2c6718977ffb2b67001c139b02ca

SHA256
f9a20821519e9947f6b8e9ae9309323453110f1033175ea07a5c8be1b87bf78f

SHA512
dd7e09ddc833bee95bc991716bb668c520f5a6b3990d53c7d46a7e2c3c01e39fb034f2968da8178119f6f7bb24dedf1a7858ed0040f3c20faae3d432c0464da8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
ecc932f1d80720b5e62c69444a5b8e15

SHA1
2a86e8f766acf4afc74085821736fd9f9cbff3c4

SHA256
81f2f83c74a6f726bce0870b0cb060effcba288977ad2d2cc0b6909204692d07

SHA512
1ffc408d688e0a91b29b682f3cc51ba5f3a0b42380dc4291aee7ea2cf6c53557c03084ad89ff9bee201aeedce47d9dbafba1612ff9e5338f0173c3084b7629c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Filesize
228KB

MD5
b1bd2b50e1d73e42880414b9bd7fd24f

SHA1
e7864570ea061c44a744adb1dc831d05f5612a66

SHA256
6030aca07cdbdadf0e2db92ecba54c16a5ee2c5ee1083bb00512d8d3467b9964

SHA512
73a771ee80bdeb423b2ed3aa1112e5dce61bc13a07bdad7832fe03c94230ac3a03fa43ad3cb9cb580804a48f54cc92255bf0b4deeacc1340810e7e9079eb6f3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json

Filesize
12KB

MD5
18261eb12378081f939fb9415ca0c9e1

SHA1
20d4ff782e17fe45e71c3f9fc60a94655f72ec7c

SHA256
12bbeec9a0af9e3ed945b28b9b8ef89b2f897768d1ba3ffd6f3fbb42fa5bc556

SHA512
fef634b4ce77c2f36ce1bdd63e8ac28e76cd089f0bff33f4425c757ddf37fe9fab30dea7b5bb51c91eb27012cf78800e03643e13d51a25bf624ce58ab3488a80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f03bd9a4-43b2-4d0f-b6c4-0d0802f11d5d.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log

Filesize
2KB

MD5
c2a00765c0c8b3836ea725f713ce44ca

SHA1
ef64d83e7323fbc06863e1d74d03383e62e5f82b

SHA256
46830c86f7af574539d9a5a0974513f26354a6cad9926b22380c242716031bed

SHA512
503d06123b41ec14396f97c8dddc6f104c4816493368c1b4835a69b267c19524740ea4804768a85b0421b5e477b0aa6196d91d580615e4526156c77707aa6bf3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Filesize
10KB

MD5
48fd246b175fb2abbf5fff2068fd38c9

SHA1
4d088b4886da7bfb8c493ab80ee67c1beefeb94b

SHA256
a18dc2f3de5f6a962586c7bbeb68080be2a4dd0677b5ffe6be42a2427e106956

SHA512
d83e86e6c6903b54c6e53918b3773c204c919b29acc7588400fda935201c6da649d91165b4d41c06f8f05159edcf022f4e64be8c12e5164a7242ab6debfafeef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
319B

MD5
f5b377dc07dcb50c099ee17461865812

SHA1
705e31b2c50e69ae8550bf4a132923df5f4bf0f6

SHA256
bbe0faaea3ad32a609668b1f8ee5c15a609ee313662f11f4e88e3b7b7db41f12

SHA512
73b2ac68ec1a5064b660dbbb6309242f23387c5dee5c90b6d69128a00d297f319f550666130e695956b89578c7abdb79dc3894d1ef9ad5bbaa5f38a8a3e7ba12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
1KB

MD5
97ba8d3f47e12a43cec79c44cc40dc16

SHA1
78991d4835e2b1fb3c8cde560b365b2f3107611a

SHA256
6d635e280d718ad42b604293865e02586d04473280ef2699e88eeb31486a4667

SHA512
004ff6941bc8bf802a8d4704fde78ca91cd72db14264469814b4819b553e05d5bceea5fff8555b69e019b30a408324e1e8bf6d46514b0287009b821c201577b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
337B

MD5
54a1e1bb2bb71d31373cf05b87b73851

SHA1
d627d64c2f4693a090d7e162f09be76ef066061c

SHA256
b8ef77ce290d7dc9f3ae80591c1c31dbd84beaa99602910c76a165524c83ce94

SHA512
1951a17b0495881564fda5ba58ecc287a07918020fa565d6423858fbcfce3f015b737a447ba68fff1dbcfc1528cb6182491a90ece3a5283c8465b4f9f6971135

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
904B

MD5
a11f695369fde1a500fab6ddf17db440

SHA1
44ac9a1188d36beea7c2a4dd2fdfddf72d6f1c5c

SHA256
812aa54969b8f188752b8fd49d08edc1d09de32935d913cded600e09fd90f628

SHA512
704329e604fc47726004d98101a6a06b29d0cf1f05f47272fb0c2c0dbb533e4b99e27d4a32ec3275eb8e7520342ddf146a0350b37f617d3e52d89f89621965b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
23KB

MD5
3a3b1de1f71a5cff1adf86545177d856

SHA1
ec6d26ca49ae7149ecfef686d561e668486225e2

SHA256
537ace2c478449c0368ea4a27772c6bbcbc2680f66b99d8b3f41d2e7fcf87db8

SHA512
0e6ecae69155e6505ceaf71da908e36c44a3646e2adee5d0ad54b3a0d071e933501e4b1f40671e37b10ff68060aadfa26b2fa187ac6c143bc10bc82f55e0d0b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
469B

MD5
0217872fc18a3bbb9d377fd0453b5c49

SHA1
840fea275818148bb5555f634b599bc0c6924cac

SHA256
ef03835c212da5fa59df62f7c9de0cd78d3490a1fd0769795a5bff367ca9a324

SHA512
4a5850c8a6e4264f4284dcf7010f8a8132967d7daee8e55e456aec4907d1b926dbfc2f0198d2155411c70a51738ff75e2fd6ab4dcf12e2ffea9becd680158716

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_0

Filesize
44KB

MD5
2d05755da10fe87d94e9ae0450bb500a

SHA1
6f932480792141b64c4bf682eb6d5070b8be8746

SHA256
e4f326b616e0768de099e2a201b8f8c3503e8ec0d0e08792f9ea63ddde9d7963

SHA512
21ca1cf95649d886e7f19a753e2f45fd08226d365be33959efe800df3ff71c8ed7ea24c1bc79e70dcef47d1313dc48457d23873e34a61cbf10dfc5d6acc4d3a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1

Filesize
264KB

MD5
eaa5907c71a9198bbd7161d0fd7b7d53

SHA1
ba51842ade87563cb9313296716a445efc6e7eaf

SHA256
c03d9b85c68853ed7cce343d271bac5f6db7e91d145518d9e8915eb1b2cf8716

SHA512
e0fa572c89560f97dc2fd64ee8739d8ad4eff97071add40933da9d376930fd8296b1b708cb882b8dd1183712d23fd3818fd2b2fc9f5531638cdee3ff404368b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_3

Filesize
4.0MB

MD5
a44cb458cc7bf078fe41003ba028f02d

SHA1
0cd14ce3d37db84c82f458b1035e1f556d9975d5

SHA256
7cd99377421de54fb40711166187653074ae161bea129e698ccb118b647d3c8a

SHA512
7aa055d9e2e286ae152b28373fc497c1e58cc8cdad88c87281c241d3094ca464783c314484932f89bc28d6b2cc192be671bae37ffec49e2f6c4100aafcd06a16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\f_000001

Filesize
16KB

MD5
7be1fc8b911462b5fe38a30407e140f8

SHA1
4f530a02b4326732500256ed9d92669c92ad091b

SHA256
2b0b0f156f848407c9035f4e723d1ad8019f65ae5c2acf1da1e3391d57f4cffa

SHA512
6807b97459a2c530577a536dc34716118e64b57292c954337fbd19fe32aa28761465a9a908fd7dead028fcf9f253a422671000f01186ee2c16f43e9f366f0950

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1

Filesize
264KB

MD5
9092334e65b8f0163809871335439f3c

SHA1
c14c4a1f160ef63ddd066179e6ef2ee2c8336376

SHA256
1a36d0289de63e366e2f57fcc2bae9d4e98b1c772f029bab28105bc1e7b1b91d

SHA512
ef05007b11bb853330c2dedc32f1df5270428dd7acddc6dcc90b243635b410e84b7985da2e8c70f96b228d4c7616f1e32bbd96a677f26d2dd4762371bdc30b38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser

Filesize
120B

MD5
a397e5983d4a1619e36143b4d804b870

SHA1
aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4

SHA256
9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4

SHA512
4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
13B

MD5
3e45022839c8def44fd96e24f29a9f4b

SHA1
c798352b5a0860f8edfd5c1589cf6e5842c5c226

SHA256
01a3e5d854762d8fdd01b235ce536fde31bf9a6be0596c295e3cea9aaf40f3dd

SHA512
2888982860091421f89f3d7444cacccb1938ef70fc084d3028d8a29021e6e1d83eaef62108eace2f0d590ed41ece0e443d8b564e9c9a860fc48d766edb1dc3d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
114a152658270e7b4229629c584fc1c0

SHA1
ed190a022fa64ea890e4d403e3dc528b44b2bc5c

SHA256
a7351c7bd7fcb0e5c6efa189eefb77c6f87777c1feac25ae9ce74941c1c137d2

SHA512
0c0811befe5a203b7e248ed4bd25f2fc1462d240641462d4a282ada49f8c72c2485267150f306d3f980b144e56758c6826b0f4a18446bec209427fef4ef00a92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
709f0ac72fb6efc2cea24e413de4e3b0

SHA1
84308646e15e1d3cacdf96edf958170cf9fcc881

SHA256
a3717835259640b61de90dd9bb514013dd2603a3f52003471d539b7934bcbe4c

SHA512
1a3e12132f2ca99fd2be83886b0c0b5c9677468090bdced2b5957e2e74d736e04447a7cae452703edb77a3b758f1fc02716d71acf8ce91e5b4e30ce2f8fe1753

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
b3c2e3b1117d354b64c984a11d17cb09

SHA1
77891a7a6aac48a10ca193e716d79d8d8f155537

SHA256
37eda7226e44830669e5538a1210ce71d1785caeb3f3fe4f675d0ab903013c8b

SHA512
0c1298b2c38f000f7f9d5366113031de52e5cd6f86756436455f1d81064ce5456b78aed1e8e4b1ae8bc003e3dd528c572eef3c14186a078de8bb7c7a25bf6045

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
8442d395dfd9be0822108048cf115ef7

SHA1
eb8e3b8f7231135c02d2aa42ead1a0172dc1f4b5

SHA256
b3b36e2f81f645f942dbc26f143b415a70beee4dd157eb28f4cc84b34c578f39

SHA512
2b2b928dd75cfa88edb6237c6f20690b505f79502586bfebaf23fb2c1f82d0a9146af6bf787e4cb1a80f05fef5a1c3071957a8773f4b7fddc3e5ff1a53395b8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
905b27e5c145bac046b70155a0c26f6f

SHA1
b07a3f20ec51dd2a289eec889fe66277374fd445

SHA256
9ef1c292cdf48e2d1837bad2891f75761cc59bfcad19f462ace4726a9c1e1217

SHA512
48a8d73ed1f5b56971a9f3a6677d0e86e0902b80c5bca67069b790d4ceeb18b43a853f078d61a4ef81cf4d594005207697e5d2ccdaf3b6b50bba8b9b664717c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
e2733a2b6bfc458d78b2a9cb30508ebe

SHA1
3b0bd250a596c21ff34160ec53b1569a8075be3f

SHA256
6035c0206094fb8ad883be388656d80752b44d5ef22910170339df54a608e6ef

SHA512
2876a07816560a94b097580ed385220a2d2a624b2ba4cc965c2b689ebf76ea561777a36ae640468ff22c9209939489810c57c6bafa56bbe6a88b2ee7371501b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
70999f19a4248c5c1fba75ebf38fae38

SHA1
4296998aa616bcd962a865ec53f4456b6b7a7bbe

SHA256
ca4cb466272aaa9399c055696aac28400e85bca6ededadb16715f4c1fcbc4ec2

SHA512
e1ad1ce11178131796855b761e62f4d2336496184c5ad951a2e882e08a3659120dc94b79c0200d0f9aa4f08264c7ee43e4eecd5b7ab1fc7a5ef477b4d60bf142

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
fbdd57a9da7a4d93bc7b81bd68455a24

SHA1
58b4c70cced7a7889b1ee8ae4ec779a7466ce95e

SHA256
0c0683af2fa8fed1d800306d95d86b22b526d2cd0160c6103449bc60736c0c51

SHA512
f2815cc2a2864e436b4c2e000681ab7a4e10ffb93f2df445aef6b418f7e5789b1868da5c78b588fd35fc11ae90efbe7172a34d6a3f5553428a2f66519fdc4873

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

Filesize
264KB

MD5
5303e2441ca0c4eea2a2cae4d4ac2171

SHA1
edcd3c0ace0bc45eae76c29c243ea0bfdc8f9d41

SHA256
147ec12df79df64902e372695f3fa6bb5cdc4fbec5b60f17ab815458d7dede6e

SHA512
8dfb900070b6eb510cf78765277a21463f09aa13c3a5531e502c6b559d3bb0aa20fc58d42dd75e6e38db93c5f42f5539070335d380074a28767f074ec658b8a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations

Filesize
86B

MD5
961e3604f228b0d10541ebf921500c86

SHA1
6e00570d9f78d9cfebe67d4da5efe546543949a7

SHA256
f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed

SHA512
535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db

Filesize
68KB

MD5
7ea698a737fd98a7c118f44c047474a1

SHA1
12d6ed9eae5073a44ec7062c880fa9026605aa57

SHA256
df22a6161f5e32987460f3027bb952784b98a78a6fa819eb67d905ee49c50816

SHA512
8cb33963a8271bc9a7bb4e27c17d7fb9ddc6f3e6e0d22a1da98f7cdf3523b071d8f6bf01f033163c7089f21a4ee54ac78729c5e264517a9e929f6f56a7d79432

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db-journal

Filesize
8KB

MD5
969e9142f413839adfb94be201e5b2a4

SHA1
0028f00a42df53ffec5014bcac6ff95384a05efe

SHA256
479751c60b36e71d468ebb4cbb0ba714c25919c9168ebe73d31e11b25823aae3

SHA512
c8e7235dbf82f2e720b448ac36a7a448bd195caa6631034eed1b592d1e304274532a17f92d83b7e88e26ab7a5afe794746dee79dd94221068d0434e3a5124064

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
1d996e8a22792802510c62b098b6957f

SHA1
be9d701153ad1cff9d0178d7fd8a55937d57f2da

SHA256
e90f172e3f0a40352e30af31c4750395b78638ebd0249bc8fc6916dd03c74b16

SHA512
59ae7087f9da790ae95d78c6657d7bdf907fab17aea6b3082bed73ab0422f9b0de29db635ce9c5cb6ae6ee9d9d7ba1c94ccc87fc384b61514060770786f44c0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Filesize
2KB

MD5
1945451d7290ffceaf10c743b9faae09

SHA1
5763f79e27155f0014391f356bbd3e0561d03e52

SHA256
60e76f6ab48172fea7e418adab7586f470deed441e123f5fc31d0c19e4c34482

SHA512
9c54e23e087568dafe9f1c2c7882f388d38dc58e69f45aa8cdafa6b1f188a4e4079fe40e33d245305df860f4541a25da0c0b9ff03e1664ed97ca52dcb5de9e75

Download Submit
C:\Users\Admin\AppData\Local\Temp\cv_debug.log

Filesize
2KB

MD5
4464ae0c382c0d880f8ac147ce8f4fd8

SHA1
c1314e93f32a20598be9f9189bb06d4458ba0653

SHA256
776c9a7454f29da90cd82658fe3502410a8f2003b708fe3929ac47d2ef5555d4

SHA512
3d07482dbbbef1239a8e2d33a0b3621bdfb5d0288e904c0f73fe12dc982fde42aee38fd08479602bd1405b1e06dac6b4a0d05cf190febbcfcd8b47b035e60dd3

Download Submit