cefb809a5176ae85fa381fba3b62bbaceee2155f4b78f5ffc46aed7a1cf01c7c

Analysis

geolocation tags

cacanadananorth-americatoronto
user interaction
yes
max time kernel
150s
max time network
151s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
28/06/2026, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cefb809a5176ae85fa381fba3b62bbaceee2155f4b78f5ffc46aed7a1cf01c7c.pdf
Size 22KB
Sample260628-e63c6afs6n
SHA256 cefb809a5176ae85fa381fba3b62bbaceee2155f4b78f5ffc46aed7a1cf01c7c
MD5 148a25aadbe0faeab73fdea2ae43a92a
SHA1 f59dbfea501d72250e38736e84f9873dc9026f38
SHA512 0234349c57d3581ab827384791b7e8a62d621e936ca17a2767a31870f6916969ad067dcae41312f392d61a7e62df89e7e07d4f6e7ca2e73a0dd305ccf2a93fa0
SSDEEP 384:mH+TcZ516pQF6D0MKgUOQVD9yZEdxdJiNnxDHYDIlYDIvJoYDIR1:mH+Tc5FEVQVD+AdJEhw
TLSH
T160B24B8455ACDC58C089F4629C99F185E17F3A3685F2F592F3F79E179042140FE8622F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_5044_1263179032\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_107_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1880902449\_locales\bg\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5296	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134270949445131180"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4045429996-2364296335-1634900306-1000\{73263635-CC98-47F9-8B9D-ACDE03AE628F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4568	AcroRd32.exe
4568	AcroRd32.exe
4568	AcroRd32.exe
4568	AcroRd32.exe
4568	AcroRd32.exe
4568	AcroRd32.exe
4568	AcroRd32.exe
4568	AcroRd32.exe
4568	AcroRd32.exe
4568	AcroRd32.exe
4568	AcroRd32.exe
4568	AcroRd32.exe
4568	AcroRd32.exe
4568	AcroRd32.exe
4568	AcroRd32.exe
4568	AcroRd32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4568	AcroRd32.exe
5044	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4568	AcroRd32.exe
4568	AcroRd32.exe
4568	AcroRd32.exe
4568	AcroRd32.exe
4568	AcroRd32.exe
4568	AcroRd32.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 4568 wrote to memory of 4780	4568	AcroRd32.exe	87
PID 4780 wrote to memory of 4812	4780	RdrCEF.exe	88
PID 4780 wrote to memory of 5736	4780	RdrCEF.exe	89
PID 4780 wrote to memory of 5736	4780	RdrCEF.exe	89
PID 4780 wrote to memory of 3920	4780	RdrCEF.exe	91
PID 4780 wrote to memory of 5752	4780	RdrCEF.exe	92
PID 4780 wrote to memory of 2376	4780	RdrCEF.exe	93
PID 4780 wrote to memory of 1980	4780	RdrCEF.exe	94
PID 4780 wrote to memory of 1980	4780	RdrCEF.exe	94
PID 4568 wrote to memory of 5044	4568	AcroRd32.exe	99
PID 5044 wrote to memory of 2820	5044	msedge.exe	100
PID 5044 wrote to memory of 5296	5044	msedge.exe	102
PID 5044 wrote to memory of 968	5044	msedge.exe	103
PID 5044 wrote to memory of 968	5044	msedge.exe	103
PID 5044 wrote to memory of 968	5044	msedge.exe	103
PID 5044 wrote to memory of 2896	5044	msedge.exe	104
PID 5044 wrote to memory of 2896	5044	msedge.exe	104
PID 5044 wrote to memory of 5028	5044	msedge.exe	105
PID 5044 wrote to memory of 5568	5044	msedge.exe	106
PID 5044 wrote to memory of 5028	5044	msedge.exe	105
PID 5044 wrote to memory of 5028	5044	msedge.exe	105
PID 5044 wrote to memory of 5568	5044	msedge.exe	106
PID 5044 wrote to memory of 5568	5044	msedge.exe	106
PID 5044 wrote to memory of 3648	5044	msedge.exe	109
PID 5044 wrote to memory of 3648	5044	msedge.exe	109
PID 5044 wrote to memory of 3648	5044	msedge.exe	109
PID 5044 wrote to memory of 692	5044	msedge.exe	110
PID 5044 wrote to memory of 5288	5044	msedge.exe	111
PID 5044 wrote to memory of 692	5044	msedge.exe	110
PID 5044 wrote to memory of 5288	5044	msedge.exe	111
PID 5044 wrote to memory of 5980	5044	msedge.exe	113
PID 5044 wrote to memory of 1160	5044	msedge.exe	116
PID 5044 wrote to memory of 5360	5044	msedge.exe	117
PID 5044 wrote to memory of 3260	5044	msedge.exe	118
PID 5044 wrote to memory of 4960	5044	msedge.exe	119
PID 5044 wrote to memory of 4960	5044	msedge.exe	119
PID 5044 wrote to memory of 844	5044	msedge.exe	120
PID 5044 wrote to memory of 844	5044	msedge.exe	120
PID 5044 wrote to memory of 4876	5044	msedge.exe	121
PID 5044 wrote to memory of 4876	5044	msedge.exe	121

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\cefb809a5176ae85fa381fba3b62bbaceee2155f4b78f5ffc46aed7a1cf01c7c.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4780
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7EBEC5690E95F56082038CC44D32D19D --mojo-platform-channel-handle=1744 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4812
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=FED8B1BB4EBB5AC34F885FB18A143DD6 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=FED8B1BB4EBB5AC34F885FB18A143DD6 --renderer-client-id=2 --mojo-platform-channel-handle=1756 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5736
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=561FB111AF5DEA9A9F0E60DCDCA38713 --mojo-platform-channel-handle=2292 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3920
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=8AE0B66CB574FE18378B5110B2555360 --mojo-platform-channel-handle=1924 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5752
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=1A64576457819763D1A193F3B4745850 --mojo-platform-channel-handle=1976 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2376
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=F93FDFA9A88F6BA74812A7A8FD2CC699 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=F93FDFA9A88F6BA74812A7A8FD2CC699 --renderer-client-id=7 --mojo-platform-channel-handle=1860 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://93.105.205.92.host.secureserver.net/pdf
  2⤵
  - Drops file in Windows directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x314,0x7ffad83dc188,0x7ffad83dc194,0x7ffad83dc1a0
    3⤵
    PID:2820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,8551163918306128394,10085192554007685273,524288 --field-trial-handle=2312,i,16093704557915803417,9566382769256735211,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1744,i,4471771887468819795,13389702484145196533,262144 --field-trial-handle=2312,i,16093704557915803417,9566382769256735211,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
    3⤵
    PID:968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2032,i,5344198272302880031,6338152511073437820,524288 --field-trial-handle=2312,i,16093704557915803417,9566382769256735211,262144 --variations-seed-version --mojo-platform-channel-handle=2816 /prefetch:8
    3⤵
    PID:2896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3384,i,2190290226107265295,1968412631396818417,2097152 --field-trial-handle=2312,i,16093704557915803417,9566382769256735211,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
    3⤵
    PID:5028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3388,i,9424045593325376603,3305877291182462940,2097152 --field-trial-handle=2312,i,16093704557915803417,9566382769256735211,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
    3⤵
    PID:5568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5008,i,3260758722317121075,16360420912536171067,2097152 --field-trial-handle=2312,i,16093704557915803417,9566382769256735211,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:1
    3⤵
    PID:3648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,6912308061647861253,13877383063087397607,524288 --field-trial-handle=2312,i,16093704557915803417,9566382769256735211,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:8
    3⤵
    PID:692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,5031945878718604527,17047724815033926739,524288 --field-trial-handle=2312,i,16093704557915803417,9566382769256735211,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8
    3⤵
    PID:5288
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,12130818456252747436,1531265339230658721,524288 --field-trial-handle=2312,i,16093704557915803417,9566382769256735211,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:8
    3⤵
    PID:5140
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,12130818456252747436,1531265339230658721,524288 --field-trial-handle=2312,i,16093704557915803417,9566382769256735211,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:8
    3⤵
    PID:5980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,302253981890026846,15403967958178110652,524288 --field-trial-handle=2312,i,16093704557915803417,9566382769256735211,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:8
    3⤵
    PID:1160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,9855534175944654906,7488213560925361797,524288 --field-trial-handle=2312,i,16093704557915803417,9566382769256735211,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:8
    3⤵
    PID:5360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,10616981811832596273,5572797061316284502,524288 --field-trial-handle=2312,i,16093704557915803417,9566382769256735211,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:8
    3⤵
    PID:3260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,508212047314631088,16091887917232344426,524288 --field-trial-handle=2312,i,16093704557915803417,9566382769256735211,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:8
    3⤵
    PID:4960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,1767814248701377409,9269555851551698766,524288 --field-trial-handle=2312,i,16093704557915803417,9566382769256735211,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:8
    3⤵
    PID:844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,16313023969989975808,9929279617133424916,524288 --field-trial-handle=2312,i,16093704557915803417,9566382769256735211,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
    3⤵
    PID:4876

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5484

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
TLSH
T178F21D566E241E3CCA9EC336340836C34D78023DACF3B762A58A719747AD181E37D6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
TLSH
T1C94379DF2A348110CA0768BABD71771BB655D0BFC1C2F0A87AD68A1780B463CE775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 0b45398263d849378db7752e069b3a2caf7151fe546d7b364af1f53adbb16979
MD5 b5e82e932ad133c4a056255c7bb33893
SHA1 2a04606720882d9563711e26971d78caa096b8d4
SHA512 2d14555242c000b9e36190bfc051066beeb32ffde7a255a5262ba0fcd65b1cf2f4875d8c1a7576e96d9e59d12b6588052fb0396fa444590b07b9a5ad07bf900c
SSDEEP 384:yeIdThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:j+eUZsLQCZsL3hUS4
TLSH
T19C53CBDB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 44e095af7ccad1927602b4b935aae3524939df30218011b877b59c782e6c6106
MD5 3c1bf221dd0438f719ae47a265c3e436
SHA1 b382689171539f473d331bdcef3739b0fa0b1062
SHA512 b7f8bf66ea12f9b37e5f8d1af222c106c1dfa377331d2153d9380edcc3af7381e9c3490378c0b160e05f5c4fd2e1590d5cb8ed07cdeb7b74fb7b38b0e8e1e57f
TLSH
T18ED080333D4D7015E35D5175A463C7153B7648611497DF01F166CA7CD9F61C466C71C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fc69248227d1b80ff41106426895bcd599abcddfbfe7fdbeabc0fcc2aca903ae
MD5 be6741080fa256162cf6b0264133ca7c
SHA1 4914334b0edd1e4c3a470920450bdee63ee2f5b6
SHA512 8d42ac6412ff316aaa68e317e92c2167dbcac331381aec8d8be8410c5bfab4657127a0601dfc90f771660e393667d62af5e917155d6fcc5c7aa6a8ca1e03f903
TLSH
T149D08037394D7015E35D5175A463C7152B664C611497DF01F166CA7CD9B61C462C71C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 75d4238a947f9fe330b4a8d53a75d6f5a0c36f22006bc7ae6d4efe32c6b44b4e
MD5 d74a9b680a2e0d4a46c4b49500a9c6b9
SHA1 15dcaa70b1d196a4e51495b701a71b54db67e3d2
SHA512 0d1322ff68c8284480b438bf7f58547ebff07162361797f927739823f756776fca7ba2d429c4abac39a1d0448073be800bc26a21f3890075a67b9c2ea53c3644
TLSH
T171E022EACC71AC3708FD0B19A0A1474AE756239B2B80490B373C920C8FB263B4286C1C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6a873a719502acea963cac4aee97bd8b4a0ed89d56530452596c28ea0b0d00d9
MD5 54a4b5c2be51f9470fa4f3c50406d72e
SHA1 5bcb85810b7d53605a515359a30f58bad0708421
SHA512 22946da5770028353e58e069d84b616f6b71351e8fd53f641ecf8e4db6246108eb1df5917505ed2f90db2b5ba5dfc36c572bda4b7e934fbb78d4cfc0f99c53b9
TLSH
T16471093A36928895E7B221F095D0061B383144AAFADFDE172F9008F4668EB354F7253F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b200.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59b200.TMP
Size 3KB
SHA256 b067599ca16654883452a763a960777b5c05ed268cb0afc641f8c0b2899fd3b5
MD5 5996b44317b582c86197ead67309b927
SHA1 76124e34a5754e4411afa995a08f1ef2d3dcde78
SHA512 8bd666d2d6cab989d9c8bda14f18ea2151d6dfbf64ad4b3e45c468344172ff735cd8847c3890fd1b4224de851bfdb38e543fe4d79542b3ce660b136ad1ea36dd
TLSH
T1BA610A3936928895E7B231F095D0061B783144AAF9DFDE172F9008F4699EB358F7253E
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 ad0e9e98e9b026b7d63e6fa891f53175f2c30c79b2d71209f9b5eace8c2a2d1b
MD5 f49861ea3df0c9cce07c834e06c1c8af
SHA1 2f8b838aecce19b5ee457acc99175033b8b1594a
SHA512 9c6d71319997a13d5f0baa8bb353fd88f63f68fcc9e636dceff73c12932258ecbadb05a034e554690b838b3391f913049b120cb332dceaa6e7212fa8b260e011
SSDEEP 192:sxZ6RlyMqZjK1Ml8MjL/f4srGYZZyb5GzodphYM3HW6+WN/DM4/YB9l51xHIgjt2:sxZ6S7L/f4srGmZo59LHb7/Enjt2
TLSH
T1DA72F8466A3459B7CCDBD609F945BBA3D7F85523D2904E449AFC8B0C05E7AEC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 353525f0ea4a6c05c07ccff4f07584281ca744297f7c89339f3a607a766f2a4c
MD5 5cf594c71dc0c03b8e8cd389008b135f
SHA1 da338080866f9a2121093356969aa1474dd80f24
SHA512 225ed0b58709d4bdfcea06dc99ead32f65d401ad749c5c7265a1dd83a8b1f69852098e88219fd27069d8fcd703f1a1d4befa3097ac7baf223b926f5688d5d964
SSDEEP 768:P4E/ael7pLuLnC6WvCuTO8F1+UoAYDCx9Tuqh0VfUC9xbog/OVx6yVLlFX6Baroe:P4E/aezEnC6WvCuTOu1ja06yVLfqBRV8
TLSH
T1C4F20B3B7C0CCB7E4F844E9CEC2A7E9A6DE8018B5698899447FA841C03C67EF51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 61dfe57987d395ea9cbd5d6ce42b1b300786d071c5f13aeef4d37f8c23a91e87
MD5 35e8c5d0f7d24a552fe41aeff9b8c860
SHA1 f4708588a9349791c8ec1f9443d436dad6a75e1f
SHA512 da3604a175d919476e85474b0ac38673a91b1e8140278560c95dd1e2fe28c711d9f6e46ccaef2c3d07f1094fca2499cd925262da01d3713e0810121a31ccd708
SSDEEP 192:OotE42aG3iLEAs1AOvQA7uItfg1MhlfznKzO5tZBBHaFlufF5XYP7cNBv3dR5LAn:8ptDYDcfvNR1ANAJPPlA
TLSH
T178B25C16717B065238BF2508A29799379E4231A33818E4FF7BB914A21F6BE115CFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 572144bd582c7fbc42c327d9346462fd5332f765f1eb1a23ba4ba60792c0e2da
MD5 6e38dbd6268c626e4cc88a63856a584c
SHA1 a70e25d7897ced590541f4a3d77b354e132d5891
SHA512 8298ebf041cbcbbcb14a25bf6f728a4667204b21826c07cbad4574d98b2a14b94187a02bb9a6a0178a97dd5a8dfb90b1f172e9ad1e97fa013a3f93a849b5dcc4
SSDEEP 384:nkiF9CcmyWCs3sNc8TUNTUlImkrDcYhx9fBfFGKRDyTYXVhkP+lFYS/Q1lCHy/7N:/Fccps3LwgxlxGuzVhkoFYS/E73
TLSH
T173B24B35EC98CAABFDE64FC9A70E7A07DEE402A7869C89D4DAD91D0D00C719D1707C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 458351baf9c85e8782148dc011b6ebc4d4fcea3c6826bce16b200cd2bd31113f
MD5 5f558c81058f382643e8a745d4ae99b7
SHA1 6b348b5c04629823cb719e063038fbd253cd2f77
SHA512 44aea2dec4a906ffd4d0bf4cc921dc798f827d0c5021ef5e95172fd1459a9b82719e51aaaa9b62f7959ebf84d02b8ddcbbbd456a43777f851f4d79e3f4e1e2a8
SSDEEP 384:n/iF1urQXjZxh6Va3sNf8TUNTUlI4kYDcYtk/fBfFGKRDyTYiXKIJeK6HiYISy15:KF1ur0h6Q3cwgs8rGu2Z6C2c5
TLSH
T144D26B36E8A4D9B7FDE64FC9B70A7A17EEE401A7859C89D4EAD85D0C01CB19C130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 9d01bdd8bdd3b8f9404fbf8f42bc1cd9fb43024890dee5e7c34fd1abbe55ab06
MD5 41eda543e65073218d251e81594ba290
SHA1 e52abd098e67f75681074e8e6858e9aa5a21d3cf
SHA512 b49424778b090b4ac8f9cf99d2544584ff5ddb4e17d949ad2c33c64f8f3fdf730bc8a7e26411d03493a4d5506592c7c131a2a9dfe3bbc900538fe62dc7738ac3
SSDEEP 384:nYiF9CcmyWCs3sNT8TUNTUlImkrDcY9hcfBfFGKRDyTYiXKIJeT6hkP+lFYS/Q1R:jFccps3swgxd0Gu2m6hkoFYS/E73
TLSH
T1EDC25B35EC98CABBECE64FC9A74E7A13DEE401A7869C4AD4DAD91D0D00C719D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 8e5e95c55e69fbca869688aab91de16b23684848a84be1d580e34b5c4e41545b
MD5 c6ad7201243cfa66d08cf4c913f58b6f
SHA1 17e68e8177a7c3375705807cc4215263aeca6fd5
SHA512 3c45bba6ec4f9e2679d4c647800c4a07313e2de94adb59d26921f73a42241b556157ffb2a5afb527b89476a365bb3c1d969280fd4efcf751c1fce6229282c659
SSDEEP 384:nyiF1urQXjZxh6Va3sNf8TUNTUlI4kYDcYPk/fBfFGKRDyTYiXKIJeK6HiYISy15:5F1ur0h6Q3cwgsSrGu2Z6C2c5
TLSH
T13ED26B36E8A4D9B7EDE78FC5B70A7A17DEE001A7859C89D4EAD85D0D01CB19C130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
Size 152KB
SHA256 f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
MD5 d2e80cd29c43ea745d16284dc1f58ea6
SHA1 53fe0165f9f303b333be9284865c8a74f3553c0b
SHA512 375fd3e65b12f80b92a63c1cf6f0ace9fe878c1a0cb5179d869c99aad0cfde14715fd1499eab22a04f353e5f292c19d6a5aeccb43ec2ff5cd6878a5226b005ca
SSDEEP 3072:bHVqfst2F+fBXzSKmg3n0OIH1iCylcLMLgaK9enj59Ah8MuBX8Yk17CF:b1qkfBXG801idlcLMLgaOeV9A2XdBkda
TLSH
T1DBE3E13C3EDACD26C21B20F97F287587C54D8F17A10BA50BE14A84015A76B5E17E2DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 9ba64fdf12690bc24af750ffc8e144edc5fda28e40b47c6637e36760d82fc03a
MD5 b0d6f081a0ecbbc24e15755ca2fb45ea
SHA1 92ee094a6b43e98dd7623b28cbb7fcb000238278
SHA512 8252bfe20cf5e10b6bc5333ccffb4a04e1081c086c5d0829e42bfdb5244de2fdc17055e3dda4c6ab82361d61e7c8e22b872e1bdd79d193206eb97be324035628
TLSH
T1A4C02B0F187E08C48C06903AA40D0A5B06E0394020101176847F780000B421CC30096B
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 65f45415956f265274bb18fc6c92ae085e0798f7d4df6495ee2a54dceb889bd5
MD5 ba0728159c42b018f0d2cca4f463234f
SHA1 93b894c9945a94959d500b5fc5f79449c9065324
SHA512 5452a4efaa4f595fd4a5b66730306c89c663d5c06b5907e54282ef19589b955260a93f33dc8e3c5e7f8fe593925e8ec9eb33ddf754bcae6c33c90f7c9cccb8d6
TLSH
T16541065CA6EA1148B3777F56ABF6A46D487BBC372F0BA45D10110E8E0A67A40DC71B33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5980-279-0x00000194CCFE0000-0x00000194CDFE0000-memory.dmp

Download