487f4dd9bdbe94a9cf1a04a8fdec19f16f86864d05d06f0511544b3ff68c850c

Resubmissions

13/04/2025, 10:01

250413-l17t1stjx4 10

13/04/2025, 09:58

13/04/2025, 09:06

13/04/2025, 08:54

13/04/2025, 08:48

Analysis

max time kernel
284s
max time network
286s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
13/04/2025, 08:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

virusshare/3/VirusShare_4675e87be15585e66b0c88b833dd9ecd.pdf
Size

32KB
MD5

4675e87be15585e66b0c88b833dd9ecd
SHA1

b2c62b3cdc97ca86df9f06ea78bc4c59439d7a9b
SHA256

77e2bcef8ff0e68646b27591faea3e15b4a09154d0611a5004ec028df5f36256
SHA512

433f88857e55d57f01230dabb3ca5c618311c45e93c82786ab2677a7d2522e91343bcb7f8df02c83abcc9d431e0bd553022b05ab1f7c2c7f05d621f07a7e19a1
SSDEEP

768:YJ7cDLXeFL/i6XV7JCzYLggXw2E0Ua20dZU57DsM1uBsYJyWOOX8ohjaSD2stCQB:0c/XcLF8E5Z

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1560_541730978\_locales\ro\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1560_541730978\_locales\vi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1560_541730978\_locales\en_GB\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1560_541730978\_locales\sw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1560_541730978\_locales\sk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_298334299\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1560_541730978\offscreendocument.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1560_541730978\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1560_541730978\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1560_541730978\_locales\si\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1560_541730978\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1560_541730978\_locales\pa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1560_541730978\_locales\is\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_1330557364\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1560_541730978\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1560_541730978\offscreendocument_main.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1560_541730978\_locales\ja\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1560_541730978\_locales\te\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1560_541730978\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_298334299\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_1330557364\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_1106259468\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1560_541730978\page_embed_script.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1560_541730978\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1560_541730978\_locales\sr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1560_541730978\_locales\am\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1560_541730978\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1560_541730978\_locales\hi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1560_541730978\_locales\ne\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1560_541730978\_locales\en\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1560_541730978\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1560_541730978\_locales\de\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1560_541730978\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_1106259468\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_1106259468\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1560_541730978\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1560_541730978\_locales\cs\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1560_541730978\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1560_541730978\_locales\tr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1560_541730978\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1560_541730978\_locales\ar\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_298334299\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_1106259468\keys.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1560_541730978\service_worker_bin_prod.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1560_541730978\_locales\gl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1560_541730978\_locales\cy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1560_541730978\_locales\ur\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1560_541730978\_locales\et\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1560_541730978\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1560_541730978\_locales\az\messages.json	msedge.exe
File created	C:\Program Files\msedge_url_fetcher_1560_1317640399\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_90_1_0.crx	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1560_541730978\dasherSettingSchema.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1560_541730978\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1560_541730978\_locales\en_US\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1560_541730978\_locales\hy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1560_541730978\_locales\en_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1560_541730978\_locales\bn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1560_541730978\_locales\uk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1560_541730978\_locales\be\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1560_541730978\_locales\fa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6092_1330557364\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1560_541730978\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1560_541730978\_locales\ka\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1560_541730978\_locales\my\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133890083986004454"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "17"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe

Modifies registry class 32 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-446031748-3036493239-2009529691-1000\{B6B6AD9A-CB2B-41FF-93D2-61DAA44FF40D}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	AcroRd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	AcroRd32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000_Classes\Local Settings	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	AcroRd32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	AcroRd32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616193"	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000_Classes\Local Settings\MuiCache	RdrCEF.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	AcroRd32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	AcroRd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 000000000200000001000000ffffffff	AcroRd32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	AcroRd32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	AcroRd32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	AcroRd32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	AcroRd32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	AcroRd32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-446031748-3036493239-2009529691-1000\{118DCE75-05E3-4422-B772-88947893B479}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	AcroRd32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	AcroRd32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	AcroRd32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	AcroRd32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202020202020202020202	AcroRd32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	AcroRd32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2992	AcroRd32.exe
2992	AcroRd32.exe
2992	AcroRd32.exe
2992	AcroRd32.exe
2992	AcroRd32.exe
2992	AcroRd32.exe
2992	AcroRd32.exe
2992	AcroRd32.exe
2992	AcroRd32.exe
2992	AcroRd32.exe
2992	AcroRd32.exe
2992	AcroRd32.exe
2992	AcroRd32.exe
2992	AcroRd32.exe
2992	AcroRd32.exe
2992	AcroRd32.exe
2992	AcroRd32.exe
2992	AcroRd32.exe
2992	AcroRd32.exe
2992	AcroRd32.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1560	msedge.exe
1560	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4804	taskmgr.exe
Token: SeSystemProfilePrivilege	4804	taskmgr.exe
Token: SeCreateGlobalPrivilege	4804	taskmgr.exe
Token: 33	4804	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4804	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2992	AcroRd32.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe

Suspicious use of SetWindowsHookEx 19 IoCs

pid	Process
2992	AcroRd32.exe
2992	AcroRd32.exe
2992	AcroRd32.exe
2992	AcroRd32.exe
2992	AcroRd32.exe
2992	AcroRd32.exe
2992	AcroRd32.exe
2992	AcroRd32.exe
2992	AcroRd32.exe
1884	AcroRd32.exe
1884	AcroRd32.exe
1884	AcroRd32.exe
1884	AcroRd32.exe
1884	AcroRd32.exe
1884	AcroRd32.exe
1884	AcroRd32.exe
1884	AcroRd32.exe
1884	AcroRd32.exe
5736	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 5348	2992	AcroRd32.exe	97
PID 2992 wrote to memory of 5348	2992	AcroRd32.exe	97
PID 2992 wrote to memory of 5348	2992	AcroRd32.exe	97
PID 5348 wrote to memory of 2072	5348	RdrCEF.exe	98
PID 5348 wrote to memory of 2072	5348	RdrCEF.exe	98
PID 5348 wrote to memory of 2072	5348	RdrCEF.exe	98
PID 5348 wrote to memory of 2072	5348	RdrCEF.exe	98
PID 5348 wrote to memory of 2072	5348	RdrCEF.exe	98
PID 5348 wrote to memory of 2072	5348	RdrCEF.exe	98
PID 5348 wrote to memory of 2072	5348	RdrCEF.exe	98
PID 5348 wrote to memory of 2072	5348	RdrCEF.exe	98
PID 5348 wrote to memory of 2072	5348	RdrCEF.exe	98
PID 5348 wrote to memory of 2072	5348	RdrCEF.exe	98
PID 5348 wrote to memory of 2072	5348	RdrCEF.exe	98
PID 5348 wrote to memory of 2072	5348	RdrCEF.exe	98
PID 5348 wrote to memory of 2072	5348	RdrCEF.exe	98
PID 5348 wrote to memory of 2072	5348	RdrCEF.exe	98
PID 5348 wrote to memory of 2072	5348	RdrCEF.exe	98
PID 5348 wrote to memory of 2072	5348	RdrCEF.exe	98
PID 5348 wrote to memory of 2072	5348	RdrCEF.exe	98
PID 5348 wrote to memory of 2072	5348	RdrCEF.exe	98
PID 5348 wrote to memory of 2072	5348	RdrCEF.exe	98
PID 5348 wrote to memory of 2072	5348	RdrCEF.exe	98
PID 5348 wrote to memory of 2072	5348	RdrCEF.exe	98
PID 5348 wrote to memory of 2072	5348	RdrCEF.exe	98
PID 5348 wrote to memory of 2072	5348	RdrCEF.exe	98
PID 5348 wrote to memory of 2072	5348	RdrCEF.exe	98
PID 5348 wrote to memory of 2072	5348	RdrCEF.exe	98
PID 5348 wrote to memory of 2072	5348	RdrCEF.exe	98
PID 5348 wrote to memory of 2072	5348	RdrCEF.exe	98
PID 5348 wrote to memory of 2072	5348	RdrCEF.exe	98
PID 5348 wrote to memory of 2072	5348	RdrCEF.exe	98
PID 5348 wrote to memory of 2072	5348	RdrCEF.exe	98
PID 5348 wrote to memory of 2072	5348	RdrCEF.exe	98
PID 5348 wrote to memory of 2072	5348	RdrCEF.exe	98
PID 5348 wrote to memory of 2072	5348	RdrCEF.exe	98
PID 5348 wrote to memory of 2072	5348	RdrCEF.exe	98
PID 5348 wrote to memory of 2072	5348	RdrCEF.exe	98
PID 5348 wrote to memory of 2072	5348	RdrCEF.exe	98
PID 5348 wrote to memory of 2072	5348	RdrCEF.exe	98
PID 5348 wrote to memory of 2072	5348	RdrCEF.exe	98
PID 5348 wrote to memory of 2072	5348	RdrCEF.exe	98
PID 5348 wrote to memory of 2072	5348	RdrCEF.exe	98
PID 5348 wrote to memory of 2072	5348	RdrCEF.exe	98
PID 5348 wrote to memory of 2168	5348	RdrCEF.exe	99
PID 5348 wrote to memory of 2168	5348	RdrCEF.exe	99
PID 5348 wrote to memory of 2168	5348	RdrCEF.exe	99
PID 5348 wrote to memory of 2168	5348	RdrCEF.exe	99
PID 5348 wrote to memory of 2168	5348	RdrCEF.exe	99
PID 5348 wrote to memory of 2168	5348	RdrCEF.exe	99
PID 5348 wrote to memory of 2168	5348	RdrCEF.exe	99
PID 5348 wrote to memory of 2168	5348	RdrCEF.exe	99
PID 5348 wrote to memory of 2168	5348	RdrCEF.exe	99
PID 5348 wrote to memory of 2168	5348	RdrCEF.exe	99
PID 5348 wrote to memory of 2168	5348	RdrCEF.exe	99
PID 5348 wrote to memory of 2168	5348	RdrCEF.exe	99
PID 5348 wrote to memory of 2168	5348	RdrCEF.exe	99
PID 5348 wrote to memory of 2168	5348	RdrCEF.exe	99
PID 5348 wrote to memory of 2168	5348	RdrCEF.exe	99
PID 5348 wrote to memory of 2168	5348	RdrCEF.exe	99
PID 5348 wrote to memory of 2168	5348	RdrCEF.exe	99
PID 5348 wrote to memory of 2168	5348	RdrCEF.exe	99
PID 5348 wrote to memory of 2168	5348	RdrCEF.exe	99
PID 5348 wrote to memory of 2168	5348	RdrCEF.exe	99

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\virusshare\3\VirusShare_4675e87be15585e66b0c88b833dd9ecd.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5348
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=FAC24A2A0D2EE23BF50AE867A0C80F59 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2072
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=3B5E3B0A8154106F8051C39F7FFD5993 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=3B5E3B0A8154106F8051C39F7FFD5993 --renderer-client-id=2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2168
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=23411E650C1109BE13BE7DD3AC744FC9 --mojo-platform-channel-handle=2316 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2948
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7CF5E2A4B72CEA4C5CF2AEC65E47A27A --mojo-platform-channel-handle=1808 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4312
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=0F7686E11CE8BF755C6273AB6E0628A6 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=0F7686E11CE8BF755C6273AB6E0628A6 --renderer-client-id=6 --mojo-platform-channel-handle=2336 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3908
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=718FD0F1D908618050A27C37F3ED7BF9 --mojo-platform-channel-handle=2680 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4688

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4100

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\bb4de437c16147b39dc2a80006452076 /t 1320 /p 2992
1⤵
PID:5320

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2000

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\4a1a673fc74137b1e3a2cc\2010_x64.log.html
1⤵
PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument C:\4a1a673fc74137b1e3a2cc\2010_x64.log.html
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:1560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffde06cf208,0x7ffde06cf214,0x7ffde06cf220
    3⤵
    PID:5268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1812,i,18276113216372943819,18431544781376885412,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:3
    3⤵
    PID:3976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2216,i,18276113216372943819,18431544781376885412,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:2
    3⤵
    PID:3652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=1420,i,18276113216372943819,18431544781376885412,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:8
    3⤵
    PID:3364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3496,i,18276113216372943819,18431544781376885412,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
    3⤵
    PID:4364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3484,i,18276113216372943819,18431544781376885412,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
    3⤵
    PID:5344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4828,i,18276113216372943819,18431544781376885412,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:8
    3⤵
    PID:2692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4868,i,18276113216372943819,18431544781376885412,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:8
    3⤵
    PID:5244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5484,i,18276113216372943819,18431544781376885412,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:8
    3⤵
    PID:2904
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5628,i,18276113216372943819,18431544781376885412,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:8
    3⤵
    PID:1564
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5628,i,18276113216372943819,18431544781376885412,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:8
    3⤵
    PID:208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6040,i,18276113216372943819,18431544781376885412,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:8
    3⤵
    PID:2232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6076,i,18276113216372943819,18431544781376885412,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:8
    3⤵
    PID:4528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    PID:6092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x260,0x7ffde06cf208,0x7ffde06cf214,0x7ffde06cf220
      4⤵
      PID:6044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1836,i,8491816151965085703,8552574796588405996,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:3
      4⤵
      PID:4008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2224,i,8491816151965085703,8552574796588405996,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:2
      4⤵
      PID:5620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2520,i,8491816151965085703,8552574796588405996,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:8
      4⤵
      PID:2328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3948,i,8491816151965085703,8552574796588405996,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:8
      4⤵
      PID:5508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3948,i,8491816151965085703,8552574796588405996,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:8
      4⤵
      PID:4884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4496,i,8491816151965085703,8552574796588405996,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:8
      4⤵
      PID:2464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4240,i,8491816151965085703,8552574796588405996,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:8
      4⤵
      PID:2004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4680,i,8491816151965085703,8552574796588405996,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:8
      4⤵
      PID:5040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4568,i,8491816151965085703,8552574796588405996,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:8
      4⤵
      PID:2640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3472,i,8491816151965085703,8552574796588405996,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:8
      4⤵
      PID:5376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4928,i,8491816151965085703,8552574796588405996,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:8
      4⤵
      PID:456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4148,i,8491816151965085703,8552574796588405996,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
      4⤵
      PID:1944

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4460

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:1012

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:932

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\virusshare\3\VirusShare_4675e87be15585e66b0c88b833dd9ecd.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1884
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:4224
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=8BA1BB84EA9599650FB8631D98BD67B9 --mojo-platform-channel-handle=1760 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3368
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=C331C8A87FBDBD0E35ACAECC5CE44E34 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=C331C8A87FBDBD0E35ACAECC5CE44E34 --renderer-client-id=2 --mojo-platform-channel-handle=1764 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3796
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3F6D869ACA1FEA715B0D342E46CB0009 --mojo-platform-channel-handle=2440 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2808
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=DC66556D9D6E0F850E4FDD3FCB5D081E --mojo-platform-channel-handle=1884 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4308
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=CEEAD39E00BCA15FE599D412FDF86B59 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=CEEAD39E00BCA15FE599D412FDF86B59 --renderer-client-id=6 --mojo-platform-channel-handle=1844 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4492
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=87107D39DAB26DCFBBCABA3B9CC57185 --mojo-platform-channel-handle=2496 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2444
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=5B21FD286B7C0230C9A22F7A754413A7 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=5B21FD286B7C0230C9A22F7A754413A7 --renderer-client-id=10 --mojo-platform-channel-handle=2116 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:468

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\6214443d9b2a497fa6190be83d447f32 /t 5988 /p 1884
1⤵
PID:5324

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3840055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping6092_1106259468\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping6092_1106259468\manifest.json

Filesize
79B

MD5
7f4b594a35d631af0e37fea02df71e72

SHA1
f7bc71621ea0c176ca1ab0a3c9fe52dbca116f57

SHA256
530882d7f535ae57a4906ca735b119c9e36480cbb780c7e8ad37c9c8fdf3d9b1

SHA512
bf3f92f5023f0fbad88526d919252a98db6d167e9ca3e15b94f7d71ded38a2cfb0409f57ef24708284ddd965bda2d3207cd99c008b1c9c8c93705fd66ac86360

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping6092_1330557364\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping6092_298334299\manifest.fingerprint

Filesize
66B

MD5
496b05677135db1c74d82f948538c21c

SHA1
e736e675ca5195b5fc16e59fb7de582437fb9f9a

SHA256
df55a9464ee22a0f860c0f3b4a75ec62471d37b4d8cb7a0e460eef98cb83ebe7

SHA512
8bd1b683e24a8c8c03b0bc041288296448f799a6f431bacbd62cb33e621672991141c7151d9424ad60ab65a7a6a30298243b8b71d281f9e99b8abb79fe16bd3c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping6092_298334299\manifest.json

Filesize
134B

MD5
049c307f30407da557545d34db8ced16

SHA1
f10b86ebfe8d30d0dc36210939ca7fa7a819d494

SHA256
c36944790c4a1fa2f2acec5f7809a4d6689ecb7fb3b2f19c831c9adb4e17fc54

SHA512
14f04e768956bdd9634f6a172104f2b630e2eeada2f73b9a249be2ec707f4a47ff60f2f700005ca95addd838db9438ad560e5136a10ed32df1d304d65f445780

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
0d45fed6427160759a85966eec4a30a5

SHA1
8af848e3760e5332093d34985d249d5bfeaef053

SHA256
f5592d111a597b9d7c308fdd700396e32fbb4ecaa7e7dce3ec0172ea1e5dbb3a

SHA512
93028f9d2d319579e760fb8fa4474ef24c83f82ae50d995c8d9c24db6a0708ebcf690cab7a5280ef5187ef2a7373086f8ca783371099b87a16cc6758a09f6fe9

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
b893d8421ccb734878d80288af09d641

SHA1
29f4ae5d0a1594a2fac81dce2db397b51b06f630

SHA256
66466ba79565ab111c2538ad0909c5b7644ae9f3766716b7d31b6d1db179e902

SHA512
9126a203c84f6aa126f06893f3db9f73fa71a4411bc01a43c21efbe4b89c962638941bfb0a7adf298776cedefd639fe850b0b301a7f05da118988266014b2bbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
025f4f78544dc4e3b621871210f1175d

SHA1
ba519c553151dfd6cb81bd9907c933481b237f75

SHA256
ee0dae1577901a571a9f0a6f57bf5e846da4ea5fbeb23cbf009caa69cd1a6189

SHA512
3e7a64e0994d6c03cb0e71d2c6b16dc54b5b4ff0213d8c6302f4cdeee95b7c10cc87c301d5dc4c624ca8ae4b0ddc01363873cbaf7d7324c389ce910b7825ae63

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
36KB

MD5
b30d3becc8731792523d599d949e63f5

SHA1
19350257e42d7aee17fb3bf139a9d3adb330fad4

SHA256
b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

SHA512
523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
56KB

MD5
752a1f26b18748311b691c7d8fc20633

SHA1
c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

SHA256
111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

SHA512
a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.9\protocols.json

Filesize
3KB

MD5
f9fd82b572ef4ce41a3d1075acc52d22

SHA1
fdded5eef95391be440cc15f84ded0480c0141e3

SHA256
5f21978e992a53ebd9c138cb5391c481def7769e3525c586a8a94f276b3cd8d6

SHA512
17084cc74462310a608355fbeafa8b51f295fb5fd067dfc641e752e69b1ee4ffba0e9eafa263aab67daab780b9b6be370dd3b54dd4ba8426ab499e50ff5c7339

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma

Filesize
16KB

MD5
cfab81b800edabacbf6cb61aa78d5258

SHA1
2730d4da1be7238d701dc84eb708a064b8d1cf27

SHA256
452a5479b9a2e03612576c30d30e6f51f51274cd30ef576ea1e71d20c657376f

SHA512
ec188b0ee4d3daabc26799b34ee471bee988bdd7ceb011ed7df3d4cf26f98932bbbb4b70dc2b7fd4df9a3981b3ce22f4b5be4a0db97514d526e521575efb2ec6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
8625e8ce164e1039c0d19156210674ce

SHA1
9eb5ae97638791b0310807d725ac8815202737d2

SHA256
2f65f9c3c54fe018e0b1f46e3c593d100a87758346d3b00a72cb93042daf60a2

SHA512
3c52b8876982fe41d816f9dfb05cd888c551cf7efd266a448050c87c3fc52cc2172f53c83869b87d7643ce0188004c978570f35b0fcc1cb50c9fffea3dec76a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
333ed976a8f2112d97fe7056b25a7428

SHA1
c865d0ae09da2864c3a1557d642eac3671bfd9d8

SHA256
4d7e0e244297141e19fd5172fe197b45e123aa10f81911a8acb959240c112cac

SHA512
9c270258a6d169bba5dfe191bdf187515756ab91c6ad11665a6f35280e04da565c08e5bf69446c145a88fa266eea1cf0e741b7b72ed2ffbaae5529fc74978c73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
9063a844064c1b83ea0cc0ada048cdd5

SHA1
c3b7293a68d392b7e399889b2b3ae5bb49d2e7eb

SHA256
4c2bf3656a7e358ec8ae40341028f01427774fba624d6d21206350d048a22695

SHA512
20847e4e377ceeff75e85621f377502f2d10376a3333bc790fa8376f8055b97924963a4bd0a2b7afe38c4ea2e1f215f12af235f6805b4e5101ea1ff3fc3dce1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0

Filesize
44KB

MD5
3d4df86a169d7cbd829ae8cac35856eb

SHA1
74c1603f273b38a48fa32340923aff24daee4d77

SHA256
5fa2efbadca0250c8fc245891459baba355830ef3db715865d4a46692c9eeccd

SHA512
5feefd6b859bd89a108ea70119ff5d1655b51382b4a561840c320d18bbc8e53cbdb49509f21bf15c4a75bc888180f171800966f326e83779e8d6c091362bef53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1

Filesize
264KB

MD5
5e5c22e26be441624b6a26c59f9093c2

SHA1
06c85d033ac5f54e94d4f4a314b4825d0445253d

SHA256
3d367d2cdb7d57d2893152db825890c5ba875b58fa895a852f17833ce6cd519e

SHA512
94f2b7784b70cfc365dd56d7d7ff8c434df4118de89f3a091b5c84e1d044fa99f018d46beb36fa031c33fb0a8fa867bd8be760e9ad7a737874f9c7c9469dc66b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2

Filesize
1.0MB

MD5
3dd52c25473c7f5d1f92d6d439d5fa3c

SHA1
8b5f9e08d45cc97ac8cc418f5a581fe4fa5a8627

SHA256
6ada17d209a8cd55c855866cf28f6ed8ba073bdfbca5abfc9cdf9181463a2200

SHA512
49d1653821f23d42af06f3a7c3506ccea54eb40327ec6c317316c6d01cb23378a7a8ff3fe6b3aa9bdd9fc9b1e8f9a0568f65783d1576d1c6d9e5f0f51048647c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3

Filesize
4.0MB

MD5
09ef386d14161741beaca453f655ad40

SHA1
c50bdf7bc8070dafe10c6de23e4d338a9fe4da07

SHA256
73028377ef676bcb6a48076a6e48df6fd19bf7e450fc862bd2751539c86115f4

SHA512
673deca1dccc45a0356000fa7ce6f9658be13073335bb3ab607b93abfc319a32f318504821a6d2c00cc17b8f131b19532c35831ee879ad60f74587a067820987

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000054

Filesize
19KB

MD5
5e5ae2374ea57ea153558afd1c2c1372

SHA1
c1bef73c5b67c8866a607e3b8912ffa532d85ccc

SHA256
1ef458d087e95119808d5e5fecbc9604d7805ea4da98170e2c995e967da308f3

SHA512
46059e4a334e0a5295ebcef8401eb94b8fa0971b200f0f9e788ed61edae5018c917efd30b01631cbd6bdadc5240c9fcad2966ea0aa9c94b538bcc369e10bbbaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000055

Filesize
191KB

MD5
eaebb390ddb3b1c0e07904f935d29bd9

SHA1
dca8da5b24b1b18b3c8dbc2523f5d145fd4dae13

SHA256
9478515162e79256323883a5092b39e0045dc8213d7dcf7be5dcc1ec5b70e9e4

SHA512
e2dae28c4661b3bb65b3811803a9396e1c9b16eb187b60f2d4d1a8cc65e2ad6ce0931a48e942b5d920bdc263ea939b9164b649edc3752e83daabef9366a186e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
1c2f68e07859a7cf0178171ad7d6129f

SHA1
57b51429ec2f2de00fa9b560c0de66cd8bea017c

SHA256
52560fcd3d313fcf349dabe91252e4654af07b99cf6f386e6b7acfcc1f60bfb3

SHA512
647aab3896fb49ffa76f79259d4e2ef5595c7b807baa0b45a688a6ded2198e8c7e2a973c54a63e760ff511016029401cc69c6a845c3764673a021f8724e7f8dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnWebGPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Filesize
343B

MD5
0e49e8cb5c5af2f309d51839ee89af96

SHA1
af940919a538d0c68c8c9dd929ff1d8d4ec3bb2e

SHA256
c538e4795dc069805b49d0c7feb1a41279bfc8fd5cf0e5a9a8026f46b966b576

SHA512
5947719946348e3c079b80f80e04fc5ab24195181951e48530e4bf89a76640c07d978ba077aac9c29764836bdf7892c69ad7c0d9c6ea7ad6f698124ac43acd60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Filesize
32KB

MD5
9adf3c80bc17c0da65bd9f1b4394cc9f

SHA1
2c17ca953aea45790d65033bba79e3090ac0dbf7

SHA256
68df7e518e111492b101a1661351e3ac791a5c5d16a5a6196ccb1875cdeb726c

SHA512
632f05ad372b0354b1dcc5d0455f5a275a537e11d79b59a4bbdde608dae8e960d2466cbc0e6ab6ad1945cbbf3eb36c6c20ad0d77934c52913b22104a07f34648

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Filesize
399B

MD5
a15ac2782bb6b4407d11979316f678fd

SHA1
b64eaf0810e180d99b83bba8e366b2e3416c5881

SHA256
55f8fa21c3f0d42c973aedf538f1ade32563ae4a1e7107c939ab82b4a4d7859a

SHA512
370b43c7e434c6cc9328d266c1c9db327621e2c95ad13d953c4d63457a141fbf2be0b35072de96becc29048224d3646535a149229fc2ba367c7903d3e3e79bdb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Filesize
322B

MD5
cc9edf4dccfc7f8a372f914b63d358dc

SHA1
cfba7c1f323a5931d426dc94200b39e39cde6910

SHA256
dfc5ebdbc657b0a5e2ec4fb3d022f3c46997f14d338abf67e75779a7dea9caf5

SHA512
8eeb7a87991514ecd78d28fa2f232e4a4cd85616d7dc77f3fc0f7caf946c6bf4110e70169a719138a2a104eb88180997e72f25cd04124450b4ceb6483b9bbd1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
192KB

MD5
c5c9780d4739229239b0796ddea60788

SHA1
cf3be02f91179217ffb432ebbe4ec224b9b3b780

SHA256
14007a3dc2ea53f35b8be36893fda2bb064fe9e14e3b8b87de0340f3aa862b04

SHA512
67201e85f9234dd4149c9eea50f642ca19cb5ebc8a7b4645ace273b6e99af8cfe4b2442b6c02e347ff074db4bb9572c0e4828968ad3782d5bf3c6c8ed67e5743

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
2b66d93c82a06797cdfd9df96a09e74a

SHA1
5f7eb526ee8a0c519b5d86c845fea8afd15b0c28

SHA256
d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954

SHA512
95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
334B

MD5
52ef052bacbe911edb12cc8fcb4953fe

SHA1
cc1d523eb483a0cf7711134ede232b452c043400

SHA256
74b59f5d9a50a10d4a714739b5c657e86d7b85945832e8c07f0190510e24584f

SHA512
e229c5399318f00567d162964f93105b770f25f77cd01a5961f1731c00f5271c0a18b06b27fc12ed2dd8af6dbfbcd50fbabd142bf03045625f3e9d08fb3bc043

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Filesize
20KB

MD5
419ff8d10f7681dfbd1ff8aea4c1a8d8

SHA1
f78e2ca394d5bc5bc17a3a6aaeebdf25bfcd6ae7

SHA256
97d3f1f6ceaf64a7a0e68885d142f9a2249e7a5888b1a0295a17cfe5be524e30

SHA512
a4c6cb860864a110c75ad8a80d294c61929c21b2290aa30618a48fa8e847ac8d3c6a22975330e628ed8680d0cba3e4a4fb39214a0a3ff744fdc7aec4acdc3853

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
9cc7cf4bf863ddc5056005960b43233d

SHA1
b36a0b3ea10adc9370187aa376ed966d20809688

SHA256
52d3ce3fbbea13afe1821f1ff4473981a8d36a72f7059ac54b277437d468ddd2

SHA512
5853237ffc92c5afe1ffa7ad5dd2da389d54b5dc2e501e7608b403054588565a215c4497f3c88b83114917aa067e0a19fecc21de591033d6b3269659a03794c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
d3fb9273915747979666cc6e7bd799ac

SHA1
6de7469146cd0a5c8fb633f95106044e7d4aa415

SHA256
fcc1b62bc28238b00c852a09449b3a61341f750c5cb9b187c207c5a3001c9ab7

SHA512
4377f85fe6de02e4905eb4f64476d95abc661eecf749dc0990c56ef4b347468d543e9203504cca60d5b34e40613f1614fc59e18c698b56cd1c085497a87dd888

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
952cdbf4c9f04359162a8ba270d534f2

SHA1
79d6cb299f91e6a823b4bade071881af185bd396

SHA256
6abf67693aaf079a7cdce6ef53513483aca031236bf0c07ef666409c4469fe91

SHA512
ad0169fb111b3a07de6b5dc03264f7d72a7fedb2e1d583b2d4e360cd4e0e16f17898202856090d671244248bce818c1a89ef109e146ae801d34277efe47ef3c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
1177f388f8182f763b54dd07cae96add

SHA1
de61432c2779763f4471674b442306f289cf903e

SHA256
15771b81e0ca1ab718b0051b99a98133fb567ddcd040d1948d5cdd0686e3b40a

SHA512
0ef04762f2c93a43ee4f61611e2555081e926f8286b25dbb7de350762d25995c64e183e270a737612ef289d25c0103d96cc1a5c6b4ab0882532dd7d705295328

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Filesize
335B

MD5
ca31621ba9d7d5d5dc9f16dd71605245

SHA1
6971554d77b7b7e639da9d8ada7fedc7a8689e7f

SHA256
127b8c76454be19ee8616fbbcf31d00bbdb645a7529dd96b33705c317104ff17

SHA512
7041b5b13a536ecaabdd1150eab7dd39848198e27a5f938734839b05a907615b7a1626357a4e79aa4dbc9d109cb5f40c711061fef1d014175372c1efe8bde86b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
350B

MD5
5bd2f84a88e284ea0151cacf158f0b50

SHA1
79735d56b41499456687715013d60ae0cea5b7a3

SHA256
46838fea850d9285509eed279e92ab93573ff1390fa01d21b8357e6f4d66c470

SHA512
17d412f9fe1a9c77bac7d57f9e37c2af3560fcb747d02002caffa63ef822816effc772ffaa920cd6be639630e8f0c8b07892fc8cee524feb19ea734c2e9c7b7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
326B

MD5
4b1a36ade1fae55d089559d0cb7c1344

SHA1
2287db6d471b2b6968afb39950cd547e542e5db8

SHA256
d052a8c7285333d302a90d7e973f9c20d2804b956c99957fbc9b0ebad3ac8970

SHA512
c3f7b92d459d879442225a15497b1b3ac0c867b886400ca9784da204bd0510e702c353dd8c5774114968913219b7643b70d498df6b3e907fe87bdf50e462c22e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
6572339f6c80af90a27df647afb3130e

SHA1
3a5313fbac5874354a532861ab6a1814fa9f2ca7

SHA256
1a992f4e722ab52801609483767202cc8b0cdd3f801c31a6ea9e49175f6c45bf

SHA512
a0a88c09cd1531d1106449f1d2061930516ee4508b8993626bf172707e6cfb227ac5032e875deb8c4b8166b629828f3388165f166c05cff8ef8524d7018bf6c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
25KB

MD5
4d78abcb07be3b2b1ce056849dd60e66

SHA1
9e83dca73d408d2514475f9117b6220d157a8dbd

SHA256
75bb980e13a9af7deff4998be7350d90906fabc2973560f8773555748e4f7ee7

SHA512
0055fcd2c9cee1e9ad637c49920b44a72c18829e67b97cfeb2ab5b63ec3f27b9c0bd573314246e86023ab6e1908c5dbddd52f83b10133a36b99ab7316918fcb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
57471759e87268fbfe0a4af5062d4b72

SHA1
e0aa90556a677012b8fcceac0540d09614b7149b

SHA256
3e58e6b15d0f9904f3ea9e2174150741e650ebefcafe9a823dd2f6ad893b3307

SHA512
06d12ff025721840fcc1cd5bdd73e29ded6ece2e8cb21fb6501d4034c60deab139a41bd481b0c7d0a8e38aaf3ea79fcffc622b9afe5783e12d4cdec7e6c85c0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Filesize
228KB

MD5
2b3399d40cd8473e8006c566dc7b49d5

SHA1
b29fc4a88b76ad9eb6bfdaae8e990c97da2fa3b3

SHA256
51b9089d577bce50e0936743e6470089de20cd81463b3a56f89afea9eae550b9

SHA512
e1669dd5256bb07f855bf63e553ffc93b2e9411569cc4b42ab7d457f53237cf222bf0007f6dafbf746bb6fd32287c23238255b29b3e8cf5fd50ca024e7d6e47f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json

Filesize
12KB

MD5
18261eb12378081f939fb9415ca0c9e1

SHA1
20d4ff782e17fe45e71c3f9fc60a94655f72ec7c

SHA256
12bbeec9a0af9e3ed945b28b9b8ef89b2f897768d1ba3ffd6f3fbb42fa5bc556

SHA512
fef634b4ce77c2f36ce1bdd63e8ac28e76cd089f0bff33f4425c757ddf37fe9fab30dea7b5bb51c91eb27012cf78800e03643e13d51a25bf624ce58ab3488a80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log

Filesize
1KB

MD5
b85906ece222037fba9d4747289c0fdf

SHA1
a8ded71359f7cade533b896aba8d40a917def6ff

SHA256
be6455080934eb29bd23fd4104af53794399f2f8c909d966dca51c0cb157b4d6

SHA512
f30f34b44b54b18be416e4aa5162a9ef1374c6e4b00dd4a1cb55d78151fbf714a52c70d1c40b3c6942647e8699d7b99dfaad884e037c28a1547bca03fd4d8034

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fc317408-2e31-4612-8c40-5eee59196e0e.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Filesize
10KB

MD5
a6d505a15007c625fbf89dcdb0a3f19f

SHA1
83e8f62b5f43897f506b373796b442cdaa0d1640

SHA256
f99773d03088d8727211a1c18a25f75a73eb0b41d8eb55e50a9b327c786d6c2c

SHA512
38c8cfc87fe4b12c45db8f1201d3c9dd60c3aa5c53f073e127b561c5c8f4ec1a30ea0237d4a4b5f52063873a202bb23b0942688467e61adc2983f1a165517c52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
319B

MD5
eb191a4a18f0c8e8c4616aa468923ff0

SHA1
b8b9993877b464a20cc232f2fcb219bc6743b547

SHA256
b08c2095e1c2bb577035af285d52facd1cefbf2cd8c6a8fdeef0a124ee05ff2a

SHA512
1b8bc2a8eca3c8d3324133a53644c2479b874e6a9792e3d2f0ca76ee4c0e3c18a32462c64d8e04e6917ec1b6e46afbf061b19a1123272fa73f02d9208d0bb580

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
1KB

MD5
26002c2afb4b06237f6ef1ab235eff49

SHA1
6584dd46df0c71988ddeee037843f2ef5e1cd3ae

SHA256
dd4bdf3c0be3b9dc3cd987d89cbb829508c5a0fdd6e912777489cf4395eb6241

SHA512
7bc4d92341fd1a360d0311ca734d5b148dd5ad1fab26b47b6a3c682bd065742ee7336a5eb2e70f04fabd4be38f9a89ff51a70fc777c12ac3a14e785db3bfd35a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
340B

MD5
cb5ece75dac39d5bc9592c1ba8bf0e4c

SHA1
99fa4dfed5a65a5e2b64f4594bf3511e2d9e58e9

SHA256
32fe31365eacb0fbceb89e50b10c765006d349c475a4475772c848233322daef

SHA512
288efb8dcc2e7cfad1de064d0c92daf8b7f657631b9bab929aca3b6498eb68b21c0b114baded77ee95585a7451f5394e2f4d3ab0b0afaa45de5e0b970e1d1f2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
23KB

MD5
a9339a8f2701d898a338bfd64cb91a6a

SHA1
a75cadbd6213dd1ba9756ef228b9a67bd32babdd

SHA256
e67b8894f3e65cd11dbe6c076d340bd9bf619fe09e6a5ed3cfbc7c148c57c46c

SHA512
7e222d58f76a3ba3bedced4914b9139cdb205233a16d984ae96d640a4712823148cbba36b7ef4e449b3c713426e4b889fb2aa07ce1a93a23c5db534979ce9359

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
461B

MD5
f15b92d42e140e48cede591c0abb9a0c

SHA1
ccef29c3f717b2af357f3b936699f2a58ee300bd

SHA256
cf649a2c8e269bc0feaf5ebd0f62d80816f48db11159b36a00270ac0690a8e23

SHA512
a45221297558b07e021385ab4e259feac07ac894d2d015c603b2c1d66a40366e0527929f095a73af734f021f3e19172bafac4435df464cd4ac966e0631602043

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
890B

MD5
2e4e4baa6b9722f4a0b270a87ea75edd

SHA1
f837f9543cf672010fb59c7502a02d6db7155496

SHA256
c8b745955c5a46ed5a2788972fbc9d1ccfae2f7946bdec2f036d4aac68591b42

SHA512
5f6b5f4a52f46c89a511a93fc0d59259bb0b89ea0094a62fadd942b23c4e7f74a2992aa9e8d7fef52ff49754321fc7acd5075c8e6dd824c39fe6970c5973670b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_0

Filesize
44KB

MD5
4724c931a19f68df938b545d2a331cc4

SHA1
313d21b90960d22b152af660f1c4806ed41499fd

SHA256
feb9d2a2a04df7fdcdf89ec717f232e0fb7e737c88c118b7ef6c231fbb073539

SHA512
ee56d6c11f42ec561182fa2b16b511660e8918df74281b20d1fe1d842c925879538c1e9f5b74fd15a3f40f95927157decae0fa2b68af0918a9ab34cd0db078a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1

Filesize
264KB

MD5
c6f0f255ccd69f82cd8590d41dbe5967

SHA1
304d8f3a4ea8ec5c432c3891a8155c221f14d5d1

SHA256
627b0b1f504a2767103b26937df458395f3425705822c5724a65eec9d0ded0f8

SHA512
d1a2c299ccd14c41f2575d4d57df154f812e83df245b89c2bd28628730e5a479c79c7fdeb513ad7da7d3b102f19057c80990d8cff1e34182f588fd80d8c556f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_3

Filesize
4.0MB

MD5
76c959ed2bb344f728fbdfa0f93b8b79

SHA1
1245eb89fa6bb65c733d403c453b86c00df411c2

SHA256
ffaf6f384c308a51dd3480329f0b056713f06e1119e1c8daffe7845c0059115d

SHA512
7a214429f88d1f04bd87945db2347ffa98c8529fa5885c61054da83bf0d23523767aba4dea5d89d9d995910c53379e2473ec71b557de99916f9368b0ebfdd8c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1

Filesize
264KB

MD5
b4220f55a6af5b4385c73be06f3bf3bb

SHA1
3a54cf25c566e4b0fcdfd3d25a9989ca79f4fb32

SHA256
5b7dd34cd170edc12e6607dcec0dc8bc6edf9de0aeb5099a57f7e992c01ebcb0

SHA512
904190eecaa5880f192960ec1c401363a47ba8f52730e04b9dbf9c8eb97de86473374dd99a7996d5b967193b1b200d517e8d94a9a01c53886374cdcc7e546a75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser

Filesize
120B

MD5
a397e5983d4a1619e36143b4d804b870

SHA1
aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4

SHA256
9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4

SHA512
4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
13B

MD5
3e45022839c8def44fd96e24f29a9f4b

SHA1
c798352b5a0860f8edfd5c1589cf6e5842c5c226

SHA256
01a3e5d854762d8fdd01b235ce536fde31bf9a6be0596c295e3cea9aaf40f3dd

SHA512
2888982860091421f89f3d7444cacccb1938ef70fc084d3028d8a29021e6e1d83eaef62108eace2f0d590ed41ece0e443d8b564e9c9a860fc48d766edb1dc3d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
293777c5a925c1aad9c35a155d8ca2dc

SHA1
27268347360ce3c4d500caea1555a349454740af

SHA256
772a755a1997eb2415daa4e8aa816f517abc45d7f20d3e83fa8cb36f576a0156

SHA512
f39b8c3746939892751d431160427842128b97152837e89b0bf73a996cf98e24413e9de65383d6fd75328104a0aeb58f904ddc2bb768760c5073a907448682b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
947913c50811d0373eed69cbdce202bc

SHA1
816fb79ddf482aaf97ddd01ba49f95727e5aa0d6

SHA256
53b9fe351e897dc2039e73cfb0923078b13d39ba1fdf9f0f3af661baedc7fd7a

SHA512
498f911db9f53f282d4aaea4490f6669890b9bde055ff67a14a28011df4faca76cddb50d9da4b7c8b4d7d9e202dad769525ba2e58ca1a65ea1adb490bf4c2017

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
008aa71a4c853ee4248769ccf1ef3d4a

SHA1
b0a0b591ba35edffddaaf26488f0be26cf6d8c18

SHA256
6ff5acb442e1e8456e9daf7d5777ca94a0915f8a300d953466e12130844773bc

SHA512
e82efa3ccd42a960752282725a568df09ca1830ae7c48433cadf0a511f766a68e6c9ac711f6c58f172ced1ff5f314642d414cbb407cae92f90c231b69a533335

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
0e538cd2ff3ce8d3d2e50fd7f2cb7cea

SHA1
4777bfe270a15b1dcf2f055d1e00f173850058c0

SHA256
3d4fb7ab0b4c6170c123b638618dce6dfff66dd423d8d3512ede94be5e626a73

SHA512
1f88bf24c26c55b222d5ea54a41e39048228ad47604fafb15c4c786601faf7378a8c2d6886b36aacc41a437be8020a93e3115b4334b6a1d809f9cc950ae69793

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
cdbf0cb6c89fb376fa789a05427090ed

SHA1
8d1a093232e5ac5203dd4744b737be03a33e1480

SHA256
d86bfc0b14d258d7311c13138ec827e07ecd8151b57aa72875400dca7c245ac8

SHA512
d0b865f2d92f8712b3fe82e29a4b2575060ed7d26a35c754b2904a926c8922f572fbb2975269b8030da2e57c5ed67e77b9e1c35bd129d4802b76e82df0698496

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
210b320d5225c9cefbbec47b021df7b8

SHA1
58a48523c2cf6f69141ca23e98a0a85a53be33e0

SHA256
ffa66bbc5630683b1f0c1a1d30bf5ea52fc60f5d055d4cf400baf6267d645da9

SHA512
e657db719c277f3ce4e3e083be9b3f5e53aee3c565d0828652d8d801dfdcc902c49a8b469cacc0aeba88eb66fdbfba91143924298e006dcda82af44add287e20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

Filesize
264KB

MD5
8f72747e8172cfef0add683b56c5f702

SHA1
8f6ab7aa0c7d02fa24002c98ebd922300f934053

SHA256
8afe865e7c7dc8bab4fb9a449c78d120f140d6402692af688cbc891e9841ffa0

SHA512
f24db3fbc58865419c05cb50fdb4efa218cc3694094ed28263360e7937f00da28d2109f2bb2d3bbd1814a970e418a8726d868aa9a3022e149f8cd3c92154a376

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2025.1.17.1\keys.json

Filesize
6KB

MD5
bef4f9f856321c6dccb47a61f605e823

SHA1
8e60af5b17ed70db0505d7e1647a8bc9f7612939

SHA256
fd1847df25032c4eef34e045ba0333f9bd3cb38c14344f1c01b48f61f0cfd5c5

SHA512
bdec3e243a6f39bfea4130c85b162ea00a4974c6057cd06a05348ac54517201bbf595fcc7c22a4ab2c16212c6009f58df7445c40c82722ab4fa1c8d49d39755c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations

Filesize
86B

MD5
961e3604f228b0d10541ebf921500c86

SHA1
6e00570d9f78d9cfebe67d4da5efe546543949a7

SHA256
f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed

SHA512
535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db

Filesize
68KB

MD5
b732993fee92feef21e1c2e9aa1fcc0f

SHA1
b8bffce1a85e8f568ddcfcc7e0f66b29cfcce13b

SHA256
43bc697650b73e2fdd4b361e42fdf601afee195af55fbb6307bf3a08263f810a

SHA512
6c196ee8d757d793a4f37fd874126d1abbb99b28aded0f84d48d6fd59480079a0b8d8226acd02103fc9c08e84d29286698d91b8dd356e3793de380a04431054b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db-journal

Filesize
8KB

MD5
dcf4439e8f00e1f9fbbe8882c01f2716

SHA1
7f2c369bc3fa885f5d7d25648719906021d118ff

SHA256
02d2ef75820dce9793bf25f51c9dfb7a908672a6be817bacb113b968106cca0c

SHA512
f0b69323d2b5dc135da2879845e278421d079e6adb0e228295111c141825da967d9369c4e6f7e597929674c0e937e21d31925370585eecaed0c68f83b2b75905

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
f921ccf55aca3f9d0927f2afbf3168ce

SHA1
46ea307f9d341b2038989995257b929e01c72d24

SHA256
27b6f9d080ba3bfc5a36b9b9e44c2d9049f5db2d0a76a08ac1fb0f9c6c565c2c

SHA512
7109dbd0758f97691c65d0a1a896dbfa6f6c41a1eee7ae0ea26d8b55116d3bb85650390f01087c327433709cb65a44203867a037f817040d60c77f7694bf1abb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Filesize
2KB

MD5
1dcacaecce209b7297c4e87da411f798

SHA1
247a63a4faf460d84de90c0b99e85886f97fd9b5

SHA256
93f87807f8b7f2d5608f17ae239d8268248c3bf7458ccef41a2365b192bda37d

SHA512
9714dbd0fbbd11b774399452108f7c39a26bb25663a41cf704aca9be223885d27b199a02009f56380a97d4333052b6f446e75378e5331e30b8d284fdf5317e59

Download Submit
C:\Users\Admin\AppData\Local\Temp\cv_debug.log

Filesize
2KB

MD5
b73c2511e9e42ee82c1a183c525527fe

SHA1
6c6609e9944f143e19c2a933126fbd99e04dd9e7

SHA256
df90469e0aae4031bec3ceecf25792c9188eddff40b96a1d1de58f7470524671

SHA512
ae339cc90800545aabfabeb7a23c37a80c26c6f41d338abc68733c952a8fe505d9091d26c28024b99ceddfe8f07f170e92cb4fe22a353329df2f08e87cb6655e

Download Submit
memory/2992-124-0x000000000B300000-0x000000000B44D000-memory.dmp

Filesize
1.3MB

Download
memory/4804-160-0x00000230D4C80000-0x00000230D4C81000-memory.dmp

Filesize
4KB

Download
memory/4804-161-0x00000230D4C80000-0x00000230D4C81000-memory.dmp

Filesize
4KB

Download
memory/4804-162-0x00000230D4C80000-0x00000230D4C81000-memory.dmp

Filesize
4KB

Download
memory/4804-163-0x00000230D4C80000-0x00000230D4C81000-memory.dmp

Filesize
4KB

Download
memory/4804-157-0x00000230D4C80000-0x00000230D4C81000-memory.dmp

Filesize
4KB

Download
memory/4804-151-0x00000230D4C80000-0x00000230D4C81000-memory.dmp

Filesize
4KB

Download
memory/4804-153-0x00000230D4C80000-0x00000230D4C81000-memory.dmp

Filesize
4KB

Download
memory/4804-152-0x00000230D4C80000-0x00000230D4C81000-memory.dmp

Filesize
4KB

Download
memory/4804-159-0x00000230D4C80000-0x00000230D4C81000-memory.dmp

Filesize
4KB

Download
memory/4804-158-0x00000230D4C80000-0x00000230D4C81000-memory.dmp

Filesize
4KB

Download