hxxp://windbg | Triage™

Analysis

user interaction
yes
max time kernel
181s
max time network
185s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://windbg
Sample260730-plc8msxdrc

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1568	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298879050133495"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 19 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\appinstaller_auto_file\shell\Read\command	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\appinstaller_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe\" \"%1\""	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\.appinstaller	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{731B7C06-63B9-4AA5-BF60-9E59FF4C6A27}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\.appinstaller\ = "appinstaller_auto_file"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\appinstaller_auto_file	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\appinstaller_auto_file\shell\Read	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\appinstaller_auto_file\shell	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
5436	AcroRd32.exe
5436	AcroRd32.exe
5436	AcroRd32.exe
5436	AcroRd32.exe
5436	AcroRd32.exe
5436	AcroRd32.exe
5436	AcroRd32.exe
5436	AcroRd32.exe
5436	AcroRd32.exe
5436	AcroRd32.exe
5436	AcroRd32.exe
5436	AcroRd32.exe
5436	AcroRd32.exe
5436	AcroRd32.exe
5436	AcroRd32.exe
5436	AcroRd32.exe
5436	AcroRd32.exe
5436	AcroRd32.exe
5436	AcroRd32.exe
5436	AcroRd32.exe
412	msedge.exe
412	msedge.exe
4524	powershell.exe
4524	powershell.exe
4524	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5696	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4524	powershell.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe

Suspicious use of SetWindowsHookEx 28 IoCs

pid	Process
5696	OpenWith.exe
5696	OpenWith.exe
5696	OpenWith.exe
5696	OpenWith.exe
5696	OpenWith.exe
5696	OpenWith.exe
5696	OpenWith.exe
5696	OpenWith.exe
5696	OpenWith.exe
5696	OpenWith.exe
5696	OpenWith.exe
5696	OpenWith.exe
5696	OpenWith.exe
5696	OpenWith.exe
5696	OpenWith.exe
5696	OpenWith.exe
5696	OpenWith.exe
5696	OpenWith.exe
5696	OpenWith.exe
5696	OpenWith.exe
5696	OpenWith.exe
5696	OpenWith.exe
5696	OpenWith.exe
5436	AcroRd32.exe
5436	AcroRd32.exe
5436	AcroRd32.exe
5436	AcroRd32.exe
5436	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4072 wrote to memory of 4472	4072	msedge.exe	86
PID 4072 wrote to memory of 1568	4072	msedge.exe	87
PID 4072 wrote to memory of 2056	4072	msedge.exe	88
PID 4072 wrote to memory of 2056	4072	msedge.exe	88
PID 4072 wrote to memory of 2056	4072	msedge.exe	88
PID 4072 wrote to memory of 868	4072	msedge.exe	89
PID 4072 wrote to memory of 868	4072	msedge.exe	89
PID 4072 wrote to memory of 1288	4072	msedge.exe	90
PID 4072 wrote to memory of 1288	4072	msedge.exe	90
PID 4072 wrote to memory of 1288	4072	msedge.exe	90
PID 4072 wrote to memory of 3280	4072	msedge.exe	91
PID 4072 wrote to memory of 3280	4072	msedge.exe	91
PID 4072 wrote to memory of 3280	4072	msedge.exe	91
PID 4072 wrote to memory of 1836	4072	msedge.exe	92
PID 4072 wrote to memory of 2664	4072	msedge.exe	93
PID 4072 wrote to memory of 1836	4072	msedge.exe	92
PID 4072 wrote to memory of 1836	4072	msedge.exe	92
PID 4072 wrote to memory of 2664	4072	msedge.exe	93
PID 4072 wrote to memory of 2664	4072	msedge.exe	93
PID 4072 wrote to memory of 3448	4072	msedge.exe	99
PID 4072 wrote to memory of 3448	4072	msedge.exe	99
PID 4072 wrote to memory of 3448	4072	msedge.exe	99
PID 4072 wrote to memory of 2484	4072	msedge.exe	100
PID 4072 wrote to memory of 2484	4072	msedge.exe	100
PID 4072 wrote to memory of 2484	4072	msedge.exe	100
PID 4072 wrote to memory of 1132	4072	msedge.exe	101
PID 4072 wrote to memory of 3432	4072	msedge.exe	102
PID 4072 wrote to memory of 1132	4072	msedge.exe	101
PID 4072 wrote to memory of 3432	4072	msedge.exe	102
PID 4072 wrote to memory of 4824	4072	msedge.exe	103
PID 4072 wrote to memory of 4824	4072	msedge.exe	103
PID 4072 wrote to memory of 4824	4072	msedge.exe	103
PID 4072 wrote to memory of 3408	4072	msedge.exe	104
PID 4072 wrote to memory of 3408	4072	msedge.exe	104
PID 4072 wrote to memory of 3408	4072	msedge.exe	104
PID 4072 wrote to memory of 3788	4072	msedge.exe	105
PID 4072 wrote to memory of 3788	4072	msedge.exe	105
PID 4072 wrote to memory of 3788	4072	msedge.exe	105
PID 4072 wrote to memory of 764	4072	msedge.exe	106
PID 4072 wrote to memory of 764	4072	msedge.exe	106
PID 4072 wrote to memory of 764	4072	msedge.exe	106
PID 4072 wrote to memory of 4208	4072	msedge.exe	107
PID 4072 wrote to memory of 4208	4072	msedge.exe	107
PID 4072 wrote to memory of 4208	4072	msedge.exe	107
PID 4072 wrote to memory of 1888	4072	msedge.exe	109
PID 4072 wrote to memory of 1508	4072	msedge.exe	110
PID 4072 wrote to memory of 1508	4072	msedge.exe	110
PID 4072 wrote to memory of 1508	4072	msedge.exe	110
PID 4072 wrote to memory of 4448	4072	msedge.exe	111
PID 4072 wrote to memory of 1812	4072	msedge.exe	112
PID 4072 wrote to memory of 4448	4072	msedge.exe	111
PID 4072 wrote to memory of 1812	4072	msedge.exe	112
PID 4072 wrote to memory of 1812	4072	msedge.exe	112
PID 4072 wrote to memory of 368	4072	msedge.exe	113
PID 4072 wrote to memory of 5984	4072	msedge.exe	123
PID 4072 wrote to memory of 5992	4072	msedge.exe	124
PID 4072 wrote to memory of 6000	4072	msedge.exe	125
PID 5696 wrote to memory of 5436	5696	OpenWith.exe	130
PID 5436 wrote to memory of 5748	5436	AcroRd32.exe	133
PID 5748 wrote to memory of 6064	5748	RdrCEF.exe	134
PID 5748 wrote to memory of 6028	5748	RdrCEF.exe	135
PID 5748 wrote to memory of 6028	5748	RdrCEF.exe	135
PID 5748 wrote to memory of 4028	5748	RdrCEF.exe	136
PID 5748 wrote to memory of 5192	5748	RdrCEF.exe	137

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://windbg
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7fff5387c188,0x7fff5387c194,0x7fff5387c1a0
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,14476081630964029538,17187506848985906492,524288 --field-trial-handle=2040,i,11406544546219178095,14722368179553468613,262144 --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,9900978241857382839,8529651568842256232,262144 --field-trial-handle=2040,i,11406544546219178095,14722368179553468613,262144 --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:2
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,18376017321589848504,9084202623572542627,524288 --field-trial-handle=2040,i,11406544546219178095,14722368179553468613,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:8
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,4635866058359327969,17165154914940480779,2097152 --field-trial-handle=2040,i,11406544546219178095,14722368179553468613,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,4280440106264230165,15987779587904172365,2097152 --field-trial-handle=2040,i,11406544546219178095,14722368179553468613,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,18400435801630711280,8871151468030190494,2097152 --field-trial-handle=2040,i,11406544546219178095,14722368179553468613,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:1
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,11783627137777886520,8601539703187730076,2097152 --field-trial-handle=2040,i,11406544546219178095,14722368179553468613,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:2
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3748,i,12783855735265139326,12543520691971733929,2097152 --field-trial-handle=2040,i,11406544546219178095,14722368179553468613,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5236,i,12530145240497529426,5856347908968537407,2097152 --field-trial-handle=2040,i,11406544546219178095,14722368179553468613,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,4710205792372722919,1335805656310835143,524288 --field-trial-handle=2040,i,11406544546219178095,14722368179553468613,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,6652687339976016720,16532946513130477578,524288 --field-trial-handle=2040,i,11406544546219178095,14722368179553468613,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=2580,i,12903447107057173436,8240539511946847540,2097152 --field-trial-handle=2040,i,11406544546219178095,14722368179553468613,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6328,i,8283570797400229551,6001324916716660010,2097152 --field-trial-handle=2040,i,11406544546219178095,14722368179553468613,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6516,i,18149916594310795223,11483122221079718172,2097152 --field-trial-handle=2040,i,11406544546219178095,14722368179553468613,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6684,i,8733736883903268707,1596939880053992703,2097152 --field-trial-handle=2040,i,11406544546219178095,14722368179553468613,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:1
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6824,i,10780048683230640371,17183924562064671425,2097152 --field-trial-handle=2040,i,11406544546219178095,14722368179553468613,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:1
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6972,i,11741070799133854832,18066799825373720819,524288 --field-trial-handle=2040,i,11406544546219178095,14722368179553468613,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:8
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6972,i,11741070799133854832,18066799825373720819,524288 --field-trial-handle=2040,i,11406544546219178095,14722368179553468613,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:8
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6628,i,8670803633138420145,7445156097960367829,2097152 --field-trial-handle=2040,i,11406544546219178095,14722368179553468613,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,6487847363271851596,6540791558311275901,524288 --field-trial-handle=2040,i,11406544546219178095,14722368179553468613,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:8
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=4536,i,17229152412839073353,4988720562211756669,2097152 --field-trial-handle=2040,i,11406544546219178095,14722368179553468613,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7436,i,8266693035292497444,11461117960319932027,524288 --field-trial-handle=2040,i,11406544546219178095,14722368179553468613,262144 --variations-seed-version --mojo-platform-channel-handle=7444 /prefetch:8
  2⤵
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7544,i,210850214589637646,2746980537694118426,524288 --field-trial-handle=2040,i,11406544546219178095,14722368179553468613,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:8
  2⤵
  PID:5984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6936,i,3916260089063681900,2964265036975279047,524288 --field-trial-handle=2040,i,11406544546219178095,14722368179553468613,262144 --variations-seed-version --mojo-platform-channel-handle=7016 /prefetch:8
  2⤵
  PID:5992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7036,i,4657828292464309826,4734483932982528259,524288 --field-trial-handle=2040,i,11406544546219178095,14722368179553468613,262144 --variations-seed-version --mojo-platform-channel-handle=7008 /prefetch:8
  2⤵
  PID:6000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6744,i,7728163758924345065,15776646939428347119,524288 --field-trial-handle=2040,i,11406544546219178095,14722368179553468613,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:8
  2⤵
  PID:5340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6748,i,17667622800489264541,13789300693228483937,262144 --field-trial-handle=2040,i,11406544546219178095,14722368179553468613,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,2299313809557020,4693026351125923097,524288 --field-trial-handle=2040,i,11406544546219178095,14722368179553468613,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:5644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4252,i,13825934183112469459,13441116666670353965,524288 --field-trial-handle=2040,i,11406544546219178095,14722368179553468613,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:8
  2⤵
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4000,i,8887240189050962788,6139247579636453975,524288 --field-trial-handle=2040,i,11406544546219178095,14722368179553468613,262144 --variations-seed-version --mojo-platform-channel-handle=7472 /prefetch:8
  2⤵
  PID:5076

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4116

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5696
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Downloads\windbg.appinstaller"
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5436
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5748
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=02A880FB6E43301C6B48CC926352CB25 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:6064
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=95395AD5C67893EEF1D9E8DEB67DFE20 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=95395AD5C67893EEF1D9E8DEB67DFE20 --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1
      4⤵
      System Location Discovery: System Language Discovery
      PID:6028
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=505C124A0421ACA152F891C33A59B68C --mojo-platform-channel-handle=2316 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:4028
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=43EB426E214CFCE2BC5EA0A5F9A50716 --mojo-platform-channel-handle=1856 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:5192
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7F5941EC27284F27DC83E20AD20F5122 --mojo-platform-channel-handle=2376 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:876

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4524

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:4648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
TLSH
T178F21D566E241E3CCA9EC336340836C34D78023DACF3B762A58A719747AD181E37D6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
TLSH
T1C94379DF2A348110CA0768BABD71771BB655D0BFC1C2F0A87AD68A1780B463CE775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 3e6bc8a0dc84ceb4ec196abfeaf28365a43dbd7d2009b2e1b4ab5dfd25837236
MD5 f6951f4848822ab4c86386e880ece6ca
SHA1 f77d55d40a92b79cb7e9d48d155c7cdeaffdd101
SHA512 8d2e8f7d98f9344684d96633f5e6344e7e69addbeda8f4a6681358b5d80562aa242d5abfa4ceb0dc1bbc563ebf1fa7173d4c8bf1a1354213872f7a23609f2d47
SSDEEP 384:yeWdThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:9+eUZsLQCZsL3hUS4
TLSH
T17653CBDB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SharedDataEvents

Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents
Size 12KB
SHA256 c443996bec9e55cabd903fcb515b2b7953b140686c2abd48da730a9eb8b177a4
MD5 86f80aa8dee294a65d17a810150d6f9f
SHA1 401555ffa95264b31abe3bc6c14d063d3adf0da1
SHA512 aced68328d3bd9a667dc3c5d9b463e4de18600a9f3ea562eec8b46f7ca6ee089933360649a9f35b8e5bde32795bd0116f9b13e492216c6563a7bafbc9d9d52be
SSDEEP 24:TLyx/XYKQvGJF7urs2XKI8BQKIVbKIrpKIVUt6:Tel2GL7ms2XKIyQKI5KIVKIz
TLSH
T1BC426D9E4B18B733ED958539E3C301622B3C212F573329D2663149B0A91BF79A4A21D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd640af4b18734f838b65cd3f2b65e25dc669e7cc487a16f826240b353446af4
MD5 337b94f0014654439210355bd20e82dd
SHA1 26e4c8276331781253e2a807dd554b2ee3ad7e8e
SHA512 087107a51c83ccffad34c7d3f5423a0f231d30a9f78e9ed5db98eb770bada291f65c7b34d1e72284571b846a7acdf88b217ef4da25b7acff47964af1551b2e9b
TLSH
T1B6D012323B197041E71A8130E403C74017AE54B524864606A254C50D6DA90C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85f865adbe5e58c0596a4db9b9daa509b8e2bd087dbcc9a01a5a095a266757bc
MD5 29ddc94c4e214fd03f664130dd36edfe
SHA1 10dfd57508ad6ef16445956dc1ee4d8c2bffc4e3
SHA512 fa7477f3f8068f41dae4965a930de8ad11b234c1ccfcd17a84fb2bfe4c289beebc19be8d058f75ed01b6dbe7304af8270da91d31316fc94360f4fa750ab203bd
TLSH
T13AD012323B597441E71A8130E403C74017AE54B524868706A254C50D6DAA0C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 5f50b1ab4ef4496566ecf5d7c2226b407d4eb3a029f94c32260b2ff32108739b
MD5 2f88251f245214c60b2f3c111e45a245
SHA1 f434b595ce60e31bfd1b34c0f7ea518f8853d899
SHA512 6be3d1c9fb9dff9f58a9198f810b0be8ff3d4e763a1032ae20ade6bbd9c7c50744a1c888426eb59256af0db46f3a45842edc553f972b21c2d58fbc6217eebc65
SSDEEP 96:ylVQQRFcH1J8Irk5JjxOfkktqqptoCO2RfxdkXk+SCe941tFm1NakLWQ7wGiuC7:2m1pIxdKqq9VGXnSh94Nm1UqW1Gi/
TLSH
T105021C3FA7970060DF2908B964CA4C3836FA84E4FD574F8E5AD15AB3B42B3D4E296314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe590759.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe590759.TMP
Size 3KB
SHA256 30777f43fef0b843eb418f717281a0e982f80023103692ae52624bc34b6dccee
MD5 d7812b956cb5e2bb9fa799b0df347185
SHA1 0114d2f2d52cd0701de66b354f192937439105d1
SHA512 1156d7d5e47c86f7a20d931f386862c40d70b43ae249a7e893840075785b57160e48f3a2b2482f57ce348eabb8f3c606b7c910df2d395079aeaff90f4f7cff6c
TLSH
T11781C739C20341A5DB2D01B8B1CD112C34FB99E9FEAB1E958CD56B7674323D1E39825C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 fd25963e84a7ca0417c089bc0f7f8984beb3d1a5a18a87e1a254953020a9ef2c
MD5 997bd7c3144b97a403fd00bc71174373
SHA1 31960a8064af0f289ff155b347f9edf7f5268303
SHA512 345f1857ef0e96147fee943e4460978ac04508c1a90fd58036ea02f4cf5a9a91ac4097e00c56d8c2ad01fa585197c803ba9924ea00e6ddbef9b57d944b31c6b0
SSDEEP 96:DNO1nUIbkOKzBzAt5GOjH3iEBRXzPBbd9f1lK/twQ:Dg1nUIbkOK1zAt57jXigdz5b31lK/tT
TLSH
T125A1DBF7C3E5826DC92152F09E18AF1BCE2C0552436C3D1A85D4AF1BA3F2471E152B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 203c8d3e25a85469355f6c09f8a2e8392514a42d86651d5f771291db36f5c868
MD5 1f3c03b8416bdb7a01849c32a50a4302
SHA1 c3b64f60b338ad806ff0ae2a9d2760aa7cddd4aa
SHA512 c13da13f9774c95857f38392c7ba6cb75f9b11f12fcbc48727d2fda8bd1ed66380a8d404a6bab66484ad5c29b0b6adcb02355f10d9d12f3a7da3e02540617edd
TLSH
T1A2D022273A0070F6A66D3FC9906BBC9FCB3640648843DEE420E0D8BD093686C4927948
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe58d50e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe58d50e.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 75c19ca50e0aa39a65eb2783e921e2163c418dc27d0652ba38004b10fbb2ad98
MD5 d117d8e7eb430e88dbf40bc4b1a2b931
SHA1 092f639d96b4518f5af3ba4bd54ac4c9c7c87de1
SHA512 84d6dd182b97007dd783301ce13cbdc63b172c74b39b9496d3eab912fca0b935504d097ca5e6707fdc4af068796849e4451e3c670c6c6fa5effc0fc417f049ba
SSDEEP 192:sxZEQUnRRbFyM/jK1Ml8MWOy/foIspFQxrCmHbbShl7dpmgHW6+WNBr8/YTuCVIc:sxZ6nRh5uOy/fTspmRCmXSh5jHbe/I9
TLSH
T1E962D606AA24597BCDEBD219F9027B53D6F90563D6944E48E5FC8A0C04E6BDD2323C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 f8ab0bef7b2d4c3d7cbbb827aacbeadb891f0f629138d05bf15765606bd65f07
MD5 48913bd6ec4e80f3f8f47e931812a7e7
SHA1 41dc4218d2d51cea5e5815f66362e722db5504e6
SHA512 06dbb38a32868f05466e27bd1627df917a7242b859a7e0b646ebb3e041aa0f434fdfa3a48268578a396fbe579f1ccc3adf5d603f79aaca3361051d487ec5394a
SSDEEP 384:sxZ6nRh5qom4y/fTs6NiCEXSZXHbeL5n/y6dJTd:sMRhgom4y/f1NiHUHbephJh
TLSH
T1EE92D617A6208977CCDBD519FD227F62D6E51463CA914E4CA9FCCA0C04EA7ED221382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 f51544c50ce5954c7eebf2acf0108e95b21eeb57f63534cb927d8baabac670a8
MD5 9a6806feb4c1ef0f1b85b13b74638001
SHA1 162de51df81e5a9edd14152341469f236b4bfe47
SHA512 5e2df71cfec1b75b48ff32e138d850ed0933627750575ec1bfefc7d55e64395cb7d273e01813e1fc5dad5282ac950e6798020b3eadb0788b2470cd6e43aae030
SSDEEP 768:XeW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjgroI9iCYH:XeW7kf0Wvqidau1jaa5LA3jrZH
TLSH
T1CDD20A3B684CCB7E4F840E5CEC266F966ED801CB66988D5487FA884C03CB7EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index
Size 2KB
SHA256 65c2f4aa5e4206e1cfa17bb73b67779697375d0a5aa361cca4bb98cf4242f881
MD5 4c6b00023e9b476673ff754ef5363094
SHA1 f281f70a158564549d8ec24def40e5a618f43cd4
SHA512 30f94e45e0052cf51abfd15c22558c4c76f1bd927e5de8c0b539d5522dabb72af89e5dd0d768161d84bb7717aaa8aaaf4d4f6b6bff56a7ba3ceadf5b4eda9c9a
TLSH
T15051D84E4D4A7B66CD9C10B328F71482333124FE4A848B07959CA9707CC32252D6AA19
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index
Size 1KB
SHA256 7b1b52f303adff7c8f1c027991de05205c5581fa4eb3b98e32bf6919ec638d09
MD5 59d39c06a60ce45263fd1cd3023584e5
SHA1 cae0d8e11d7a3c61cdb3dd5c2df1d6be78c50373
SHA512 c4ceea15c299dca0fd50d914c8691bd509f8862b0d687f48b39384811c617b201b4e30327912ce3e0d6557aa10e1017aad293ba7df5297a6880bfecb3f5b7e91
TLSH
T103213E484EE08A2FEAA840B715B7A4E07370D8DD4321A3A35C3C35302D12759294B1CC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58775e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index~RFe58775e.TMP
Size 1KB
SHA256 deb5aaff856cbd4d49d675fc6d727396737aa5e30b6ff4dcc0e48de46a2d1acf
MD5 dd206f49f7f5c5c5dc3b9f1dd0a0b7a5
SHA1 85d829051ab88479aca77085a1bb6650564e9704
SHA512 0a49a970085052f215d21b0366d029f3bc93b9d8681fc4c9f0ddeb0a5311ff53ea64dded25e8f22da025fe4e5da8e2740b6e0ae114dcfeb0634408fd23b41b3a
TLSH
T19321489586D14E1BF984517B1957B4F4B3308C009322B7D3697C26794D36BCE1A4B0C9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dc577b94-5e5d-41ae-97a8-afa364edec75\index-dir\the-real-index
Size 72B
SHA256 94e0f9807a95576accb1858ccd1825dfa306f108b4c72442dd42fb19ec7e6f3e
MD5 28ba7fdefd0daffb7988bb80d03a9eb1
SHA1 e2dcaaab9965ebe3d6a574687376fe7d13be8469
SHA512 61ece3ecc2ae0c890fd569fe277df3a4d0bbe047455d9a0b48b94440f3831bc40bb2fe315287d43f1de99cbcb095cec94c711b9259f6578342cb00ffdafa6fc6
TLSH
T1CCA0021546D13161C01312B325D7417522948DA00602533991D5004EDCD07465A9511C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dc577b94-5e5d-41ae-97a8-afa364edec75\index-dir\the-real-index
Size 72B
SHA256 281a525793c47226d7c459a02406d886b47cd69699891553bf6505335d04cc8c
MD5 0cfafaec5c7588488e65744ab2ad6136
SHA1 0911e1de048a2af45eeaa25aec6394f8f63ce01b
SHA512 3a55fd763b8b7592cbbde383516181279273facdc05e78bbbabfea5c713f88306f179d79d509122b0c786c537dc0c63014fa202059a1308952b68c1cd313e20d
TLSH
T151A002309F800045D81212B2255747991301D8D46500171780D30054DC544544F8245D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 9f95446796b155600286107563d2b8cc2bb4bc70ccd0da7277d4cadf2a98d0e9
MD5 8ffa6531fcfd58411131331eecd615fa
SHA1 23a8e257e93bc356684b7d779e15b23925f6ca25
SHA512 ba2113e23fa80d830bf682518b45813102c46bf4279b9ff3b2fc6550ccdc6b979b4e7aa354c5ae1f1c52405f631bfa8d5bfe8f0a259c109e72af365f68a0602c
TLSH
T1A7E0D8BB2EFB2824AC7F97D538B169A0858539589504EC4E3167A29770F2755280AC26
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 c215008d5ebb3ee56a0e013c7e805f87250f428050644b995b6d1dcb9984c366
MD5 d1081b01b3edcc9d80dd4775aa390dd9
SHA1 864864219d3f37621a629c4c9ca17595654dd1b1
SHA512 fae142fc8f2d91a3a85ff0726aec649f93fc4c096bd86876f4541ff72b6fc145a2d60300b8554c9e84dee9f6d0dfd83ce69f4cca2e07a58db8dbce820de09514
TLSH
T152A00262C954D145C00003B19E6643947ED08CB84749731682AD0095986C18145E2614
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d0c8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58d0c8.TMP
Size 48B
SHA256 d36964c4a90c7fd8f2113f2b3962b1316f38355946de7c54e33bad74b5518017
MD5 69e8f4b83282cfec98bb7a255090338c
SHA1 faac039bc1fb802b0eb2fce3306315cc83f73aca
SHA512 1d05adefe75e43cfdfa2b677df5cce6952754b600b7f175bae35da6fc327c27285455e9cd702b0578e16bd8ceb6188b3367ef9bcd637d0b94e72b3f0bffd75e4
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 f2036c16d6376da503b8f8171da33e9decbdf6550a4d79a2f9b9b47de53c46a5
MD5 5845ce47222f8707cbde7654eef38a88
SHA1 890163d23f1008ecfe7ce695acd08a3515493518
SHA512 8e7478bd36d55161a4c2663091bb039a0586dfb566f644fa7ed07e445bc99b60ff0c518c02604b5e2275324c4c4e58ac9cb3650f5063394240c3ace87bd5b928
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTjNIdKeQAXyhIIXKJukRYIXKF/:KIbCKcjNmKeQqCIwKJu6YQKF/
TLSH
T1B4913942713B465138BF299896A9C5368F8235633418E8BF7BB854B21F67E114EFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5950c6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5950c6.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 f68a34558b391aa03e5e73999988d69e57188b89c96d25579b1089036baa1ef7
MD5 667e5fa2743ea5cf227c827f9e4804be
SHA1 e0bbd96a02a6fe3c893f45003c135dd63e5dd53d
SHA512 b8b6e4444aaf5d85528dd011840c4a225ffaf4d9b4d167982b0e3f6a437c0c13c899a8434a2b3599328b90f9a0c23917b394db05ae8c08e54db274e37d7df47d
SSDEEP 192:GLsNIoTGwRhPdH9BbfYZmiU10Vm8BaGBPKT++FdGsr2PNxdNPCq1U8:ssNIoTlf97b7Am2GdpqtP1U8
TLSH
T1E4321A39AD756C2B9EA3A241F48636535FB84127EAC46F44E6EC5B0C01DF3AC631681B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 f595c322c9ebb0fefac1917988b37a51f31cd3bd6fd64586da51a62f94d6530d
MD5 87ce49aa8e7490ab6d2a083f26eb5436
SHA1 95be47115e7986cee83ca0ec750fbefbf9b4426b
SHA512 4158a514d46d852e857c9b7a6ce591154e77366785bcbf3dce55f35e5bb4140682940d78748552f674fb508d26f50b1ecf0bbbc9c52ff6f95fa59328b4ef4ece
SSDEEP 384:piFRZcItYsNf8TUNTUlIlDTlf97bvwm2GdpqHP1OObjI9G6w7zi:AF5WQwg3BEmNoP129M+
TLSH
T1B8D229F658E74936E96E9703E7BD2D024EBCC067F6849A44B3D89A0CCD562BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 71194f75a396f1cda0dab8b106214360da2e6dcda92acf108550fafda8e2bb4e
MD5 3beef44c109afc9560909d16b4986570
SHA1 6b1f3ad818dac0939a15af803fbd4a953a5f61d2
SHA512 a4087e5120b41c676094cb293e00a3ccc42b0449101ff61b890e39af6f56aed091ae7efd83b9a744aebaa6eefb37cb683a9698c8c7121a26da752a0b388a2c11
SSDEEP 384:piFWZcItssNf8TUNTUlIlDTlf97bvwm2GdpqVP1OObjI9G6w7zi:AFECQwg3BkmN+P129M+
TLSH
T11AD229F648E74936D96E9703E7BD2D024EBCC167F6849A44B3D89A0CCD562BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 2efb72203c1b4c2c7e3748bfb6441bf011f601fb0f05e090d7d29635ce855233
MD5 4a7445058e63150c2e4d3701cb1bb8ed
SHA1 313eeaba26e26afe550c8da6d7350e1330a8380a
SHA512 5c96a225c0bf5ac754d056e7a273580a316430dee3185f4dc07937d5d5c303acf67d72ad6a8f1609c9e21a229294ae6f8080f9547c41f24c340f48e028094311
SSDEEP 384:piFPZcItksN48TUNTUlIlDTlf97b35m2GdpqJP1OObjI9G6w7zi:AFHGlwg3BdmNoP129M+
TLSH
T144B26C369D648D3BAEB79651F88A36179FF48177D7C4AA84B3D8DF0C019B2EC1306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 0a806d244f37aeee56a4c48910b2772135f427ffa96a522369f7a267dd407de2
MD5 7da7c9213590855bdbafe72725a57f97
SHA1 161f15ea07c59a934e776dade04b8021af55e4ca
SHA512 74efeff71aaf819bc1f82c6fbdf3aa329dd5e8014e8bccf143e74f15521789c7bb10fd8a66f503b15d02952ae410696730ac9557d3003535c95985cc18b100ee
SSDEEP 384:piFiZcItWsNf8TUNTUlIlDTlf97buwm2GdpqGP1OObjI9G6w7zi:AFQYQwg3BBmN9P129M+
TLSH
T176D229F648E74936D96E9703E7BD2D024EBCC067F6849A44B3D89A0CCD562BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c9f3c1dcfe16027e5b59d4defa8c920b49034c7f295ca31b16ef0d4cc0c5ebfa
MD5 ae96cb7d1339970bfb853a28a782b4c5
SHA1 5be833e5323c04d889468354c2fc77b760640b8e
SHA512 114a7ec9c7d2014a013ce69ca68885de61a39c3d846f8ea4b6083204d7a61819b82e40d9608bcd0a64221faa424c30654195c67e0e52f1cc124e43b6d088a02a
SSDEEP 192:MON064BAQmiUy11UW5GBPKT++FdGsfaDPLouU6:MON06eAmuW1dpcPkuU6
TLSH
T17702EA39AC796C7B9EB2AE45F48637175FE8113BE6C41B44EAE85F1C009774C234382A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 568f03ec835144f22be8f520755a0764af769eae6533a65359ee7d456f5caf97
MD5 01b277957a7d8363647229350442c42f
SHA1 674adae01e913df8958307b635eed1ccebecfae1
SHA512 52ef33f2f82190f4dcf87fdf2ca09d246cf685bb65af447efd50db9abcd32967efa983fe05cdbc384ac58145df852489a1cc489e37c7e963b73c1b1448584558
SSDEEP 192:ufLsNIkTGwRhPdH9BbfYZmiU15Nm8BaGBPKT++FdGsr2PNldNPCq1U8:gsNIkTlf97b75m2GdpqJP1U8
TLSH
T166421A39AD746C2B9EA3A241F44636435FB84127EBC46F44E6EC9B0C01DF7AC631681B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 2470be0ae56b9c57929d33574d963bc808f515a562969b34ffebaab52b2d7710
MD5 a38e0bb0b46f865703294259f029e4ca
SHA1 7ababa35695d0c8ff61cf82d409dc351322f1ca6
SHA512 0397200fcd4e757f727e25ee9aab9b47f70206fc63e04081670e4fce8a0b43e397e5e4880c6e8bbea9328b58a9e2d9e700accf5bd5dcf4c5bd50c80615406f9c
SSDEEP 384:zZcIasNIDTlf97b95m2GdpqJP1OObjI9G6w7zi:ra9BbmNiP129M+
TLSH
T1F7928D35AC755D37AEB7A111F8863A075FF88037E7C85F44A2ECDB0D059A6AC031642A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 215eefbc4e65839551d3b80e89185002eb02d8b399ad5427e4b4785c0489cb8c
MD5 9bf639d5fd33c41a247967f2564955f5
SHA1 63de9070723b1d56cd8a0298fa86b3439b2c7ad1
SHA512 1d882776340b23c16937feaf60ecba7f05f97f7fe8d512fdbc53bbc112e3233fefb910209da12cb805a82ba5d61baeb113e2da775a501b47982299a60b39c971
SSDEEP 384:piFBZcIt1sN48TUNTUlIlDTlf97b35m2GdpqXP1OObjI9G6w7zi:AFJzlwg3BdmNwP129M+
TLSH
T17BB26C379DA48D3BAEB79651F88A36179FF48177D6C4AA84B3D8DF0C019B2EC1306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e0081fc0ab496890cc62dd07f9a45ff941019c228e5a328fd6e3e694a617cb3c
MD5 e66badfea2533d8e36980c70873b527c
SHA1 437dfdfc408519a0ff262e6013849890ab04c6f3
SHA512 d49a949a00de130c1f10a3608e731d7dc93dffa3e582303b4d6255ea0dba9ba0bbf86512b66d8ad2c6ba0a2fb60a7ae5c23d96335cfc9c7aad190ffa2815231e
SSDEEP 192:/ONB64BgQmiUyCUf5GBPKT++FdGsr2PNsWwPCq1U6:/ONB6eg8f1dpqCP1U6
TLSH
T107120A39AC756C2B5EA2A541F48736035FA84237EBC56F44F6EC6B1C01EF76C630681A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d16366d9-1315-4531-9940-df13355a154c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d16366d9-1315-4531-9940-df13355a154c.tmp
Size 28KB
SHA256 9da2cd8cbc303f33434aecbcb611df03d5915b43833ba6e76e9f0e7e86f28f5e
MD5 d2a3e904653228e318e90e971a1ea1d9
SHA1 5965595001ff028252f213233d8fea97306c0ed1
SHA512 936bba10071b97b3600777d383084449526b953402b5683ed610e51b433640e6e1f20a6f94d7c4304bb025e48b1c9c065b26777b9b00c097af6c8b207a07ab49
SSDEEP 384:piFSZcItcsNf8TUNTUlIlDTlf97bDwm2GdpqUP1OObjI9G6w7zi:AFgKQwg3BImNrP129M+
TLSH
T1CCD229F648E74936E96E9703E7BD2D024EBCC067F6849A44B3D89A0CCD562BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1c04719b8f635a0ec77d200b37880885ec67ccad1433c5b5c8b8b17aab7009c0
MD5 282c3849ca91f0c10497c51b2e208fd0
SHA1 b95813abb812626fc4a88e6652a360606ba15425
SHA512 7707a46c8490adf7f3bb4f9a691236d51aad34b7e8ff862593ffa1703ae64b7e5536e2fad0585acf7860b8af408b8665f28208fd080de3ad601e79e05f0837bd
TLSH
T1A7412698B6F91148B3B76F5AABF7A86D087EB8372E07D45D10110D4E0A72A40CDB1737
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_hn5mxswf.0zt.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hn5mxswf.0zt.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

windbg.appinstaller

Path C:\Users\Admin\Downloads\windbg.appinstaller
Size 688B
SHA256 9b608158e411bec7c9348a9e6a3f76e6f93d3ff9ca6413d7b392ba487b626c1c
MD5 6fcb8860280e58f8de31458220ad93e7
SHA1 a31d9fc9c1455101fd06018c20ce655eb54be64b
SHA512 889b998aff1653bbf457d8eadd5b8ff63edb8e9ba6ac8e8f51d80534d8b95b1696b39d7b6a5447342dc5e7ecddde06a115d795070cfdf0fb94e00e0cb7067538
TLSH
T11401D306D0A0D531F755542C1305F424B37D67CB9D84C85D74FBED25120B1E8E78B193
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4524-1442-0x000001A620CB0000-0x000001A620CD2000-memory.dmp

Download

memory/4524-1443-0x000001A621070000-0x000001A6210B4000-memory.dmp

Download

memory/4524-1444-0x000001A621140000-0x000001A6211B6000-memory.dmp

Download

memory/5436-1376-0x00000000098A0000-0x0000000009FAF000-memory.dmp

Download

memory/5436-1375-0x00000000098A0000-0x0000000009F92000-memory.dmp

Download