Trojan.BPlug.3879

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run] 'haleng' = '%TEMP%\haleng.exe'

Malicious functions

Executes the following

'<SYSTEM32>\taskkill.exe' /F /IM chrome.exe
'%WINDIR%\syswow64\taskkill.exe' /f /im chrome.exe

Reads files which store third party applications passwords

%LOCALAPPDATA%\google\chrome\user data\default\login data
%LOCALAPPDATA%\google\chrome\user data\default\cookies
%LOCALAPPDATA%\google\chrome\user data\default\web data

Modifies file system

Creates the following files

%WINDIR%\syswow64\windowspowershell\v1.0\krsetp.exe
%WINDIR%\syswow64\windowspowershell\v1.0\jg7_7wjg.exe
%WINDIR%\syswow64\windowspowershell\v1.0\ubisoftant.exe
%WINDIR%\syswow64\windowspowershell\v1.0\askinstall4.exe
%WINDIR%\syswow64\windowspowershell\v1.0\piyyy.exe
%WINDIR%\syswow64\windowspowershell\v1.0\file.exe
%WINDIR%\syswow64\windowspowershell\v1.0\customer2.exe
%WINDIR%\syswow64\windowspowershell\v1.0\setup.exe
%WINDIR%\syswow64\windowspowershell\v1.0\shakmp.url
%HOMEPATH%\documents\vlcpvideov1.0.1\jg7_7wjg.exe
%TEMP%\content\1244-3440-krsetp.exe-08-52-42-117.dump
%TEMP%\haleng.exe
%TEMP%\content\1244-3440-krsetp.exe-08-52-42-697.dump
%TEMP%\content\1244-3440-krsetp.exe-08-52-43-059.dump
%WINDIR%\syswow64\windowspowershell\v1.0\d
%TEMP%\is-jpm7k.tmp\file.tmp
%WINDIR%\syswow64\windowspowershell\v1.0\d-shm
%TEMP%\jfiag3g_gg.exe
%TEMP%\rarsfx0\chrome64.bat
%TEMP%\rarsfx0\chrome86.bat
%TEMP%\rarsfx0\chrome-set.reg
%TEMP%\rarsfx0\edge.reg
%TEMP%\rarsfx0\edge64.bat
%TEMP%\rarsfx0\edge86.bat
%TEMP%\rarsfx0\edge-set.reg
%TEMP%\rarsfx0\id.txt
%TEMP%\rarsfx0\id-chrome.txt
%TEMP%\rarsfx0\id-edge.txt
%TEMP%\rarsfx0\main.exe
%TEMP%\rarsfx0\plugins-chrome.crx
%TEMP%\rarsfx0\plugins-edge.crx
%TEMP%\rarsfx0\vcruntime140_1.dll
%TEMP%\rarsfx0\chrome.reg
%TEMP%\rarsfx0\chrome7.bat
%TEMP%\fj4ghga23_fsa.txt
%LOCALAPPDATA%\google\chrome\user data\default\login data1
%TEMP%\is-1mgud.tmp\_isetup\_setup64.tmp
%TEMP%\is-1mgud.tmp\idp.dll
%TEMP%\is-ha3p1.tmp\file.tmp
nul
%WINDIR%\syswow64\windowspowershell\v1.0\d.integ.raw
%WINDIR%\syswow64\windowspowershell\v1.0\tmp.edb
%TEMP%\is-had5m.tmp\_isetup\_setup64.tmp
%WINDIR%\syswow64\windowspowershell\v1.0\d.jfm
%TEMP%\is-had5m.tmp\idp.dll
%LOCALAPPDATA%\google\chrome\user data\default\extensions\fnfhfpkmpnmlmlgfeabpegnfpdnmokco\5.18.6_0\background.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\fnfhfpkmpnmlmlgfeabpegnfpdnmokco\5.18.6_0\icon.png
%LOCALAPPDATA%\google\chrome\user data\default\extensions\fnfhfpkmpnmlmlgfeabpegnfpdnmokco\5.18.6_0\js\aes.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\fnfhfpkmpnmlmlgfeabpegnfpdnmokco\5.18.6_0\js\background.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\fnfhfpkmpnmlmlgfeabpegnfpdnmokco\5.18.6_0\js\content.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\fnfhfpkmpnmlmlgfeabpegnfpdnmokco\5.18.6_0\js\jquery-3.3.1.min.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\fnfhfpkmpnmlmlgfeabpegnfpdnmokco\5.18.6_0\js\mode-ecb.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\fnfhfpkmpnmlmlgfeabpegnfpdnmokco\5.18.6_0\js\pad-nopadding.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\fnfhfpkmpnmlmlgfeabpegnfpdnmokco\5.18.6_0\js\srchfeedyoungie.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\fnfhfpkmpnmlmlgfeabpegnfpdnmokco\5.18.6_0\manifest.json
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-693dc193-ed4.pma
%TEMP%\vbjhkjkkdsadf99\local state
%TEMP%\vbjhkjkkdsadf99\safe browsing cookies
%TEMP%\vbjhkjkkdsadf99\default\chromedwritefontcache
%TEMP%\vbjhkjkkdsadf99\default\cookies
%TEMP%\vbjhkjkkdsadf99\default\current session
%TEMP%\vbjhkjkkdsadf99\default\extension cookies
%TEMP%\vbjhkjkkdsadf99\default\favicons
%TEMP%\vbjhkjkkdsadf99\default\google profile.ico
%TEMP%\vbjhkjkkdsadf99\default\history
%TEMP%\vbjhkjkkdsadf99\default\history provider cache
%TEMP%\vbjhkjkkdsadf99\default\history-journal
%TEMP%\vbjhkjkkdsadf99\default\login data
%TEMP%\vbjhkjkkdsadf99\default\login data1
%TEMP%\vbjhkjkkdsadf99\default\network action predictor
%TEMP%\vbjhkjkkdsadf99\default\preferences
%TEMP%\vbjhkjkkdsadf99\default\quotamanager
%TEMP%\vbjhkjkkdsadf99\default\readme
%TEMP%\vbjhkjkkdsadf99\default\secure preferences
%TEMP%\vbjhkjkkdsadf99\default\shortcuts
%TEMP%\vbjhkjkkdsadf99\default\top sites
%TEMP%\vbjhkjkkdsadf99\default\visited links
%TEMP%\vbjhkjkkdsadf99\default\web data
%TEMP%\vbjhkjkkdsadf99\default\cache\data_0
%TEMP%\vbjhkjkkdsadf99\default\cache\data_1
%TEMP%\vbjhkjkkdsadf99\default\cache\data_2
%TEMP%\vbjhkjkkdsadf99\default\cache\data_3
%TEMP%\vbjhkjkkdsadf99\default\cache\index
%TEMP%\vbjhkjkkdsadf99\default\databases\databases.db
%TEMP%\vbjhkjkkdsadf99\default\data_reduction_proxy_leveldb\current
%TEMP%\vbjhkjkkdsadf99\default\data_reduction_proxy_leveldb\log
%TEMP%\vbjhkjkkdsadf99\default\data_reduction_proxy_leveldb\manifest-000001
%TEMP%\vbjhkjkkdsadf99\default\extension rules\000003.log
%TEMP%\vbjhkjkkdsadf99\default\extension rules\current
%TEMP%\vbjhkjkkdsadf99\default\extension rules\log
%TEMP%\vbjhkjkkdsadf99\default\extension rules\manifest-000001
%TEMP%\vbjhkjkkdsadf99\default\extension state\000003.log
%TEMP%\vbjhkjkkdsadf99\default\extension state\current
%TEMP%\vbjhkjkkdsadf99\default\extension state\log
%TEMP%\vbjhkjkkdsadf99\default\extension state\manifest-000001
%TEMP%\content\1468-2304-mshta.exe-11-42-14-958.dump
%TEMP%\vbjhkjkkdsadf99\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\icon_128.png
%TEMP%\vbjhkjkkdsadf99\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\icon_16.png
%TEMP%\vbjhkjkkdsadf99\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\main.html
%TEMP%\vbjhkjkkdsadf99\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\main.js
%TEMP%\vbjhkjkkdsadf99\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\manifest.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\128.png
%TEMP%\vbjhkjkkdsadf99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\manifest.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ar\messages.json
%TEMP%\ecv5852.tmp
%TEMP%\vbjhkjkkdsadf99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\bg\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ca\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\cs\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\da\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\de\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\el\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\en_gb\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\en_us\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\es\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\es_419\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\et\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\eu\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fi\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fil\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fr\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\he\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hi\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hr\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hu\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\id\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\it\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ja\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ko\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\lt\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\lv\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ms\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\nl\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\no\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pl\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pt_br\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pt_pt\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ro\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ru\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sk\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sl\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sr\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sv\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\th\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\tr\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\uk\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\vi\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\zh_cn\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\zh_tw\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\128.png
%TEMP%\vbjhkjkkdsadf99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\manifest.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ar\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\bg\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ca\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\cs\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\da\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\de\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\el\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\en\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\es\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fi\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fil\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fr\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\he\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hi\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hr\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hu\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\id\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\it\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ja\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ko\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\lt\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\lv\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\nl\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\no\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pl\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pt_br\messages.json
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-693dc19d-1758.pma
%TEMP%\vbjhkjkkdsadf99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pt_pt\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ro\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ru\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sk\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sl\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sr\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sv\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\th\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\tr\messages.json
%TEMP%\content\4076-4040-mshta.exe-11-42-21-711.dump
%TEMP%\vbjhkjkkdsadf99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\uk\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\vi\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\zh_cn\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\zh_tw\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\128.png
%TEMP%\vbjhkjkkdsadf99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\16.png
%TEMP%\vbjhkjkkdsadf99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\32.png
%TEMP%\vbjhkjkkdsadf99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\48.png
%TEMP%\vbjhkjkkdsadf99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\manifest.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ar\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\bg\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ca\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\cs\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\da\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\de\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\el\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en_gb\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en_us\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\es\messages.json
%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000002
%LOCALAPPDATA%\microsoft\edge\user data\default\000002.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\log
%TEMP%\vbjhkjkkdsadf99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\es_419\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\et\messages.json
C:\fb-temp0.html
%TEMP%\vbjhkjkkdsadf99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fi\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fil\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fr\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\he\messages.json
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\index
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_0
%TEMP%\vbjhkjkkdsadf99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hi\messages.json
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_2
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_3
%TEMP%\vbjhkjkkdsadf99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hr\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hu\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\id\messages.json
%LOCALAPPDATA%\microsoft\edge\user data\default\cookies-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\cookies
%TEMP%\vbjhkjkkdsadf99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\it\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ja\messages.json
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp
%TEMP%\af12d253-0618-47ac-8f6e-7712756d6ab3.tmp
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\log
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000003.log
%TEMP%\scoped_dir5976_1280112145\plugins-edge.crx
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\index
%TEMP%\vbjhkjkkdsadf99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ko\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\lt\messages.json
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_0
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\log
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_2
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_3
%TEMP%\vbjhkjkkdsadf99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\lv\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\nl\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\no\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pl\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pt_br\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pt_pt\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ro\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ru\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sk\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sl\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sr\messages.json
%TEMP%\scoped_dir5976_1280112145\crx_install\manifest.json
%LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel
%TEMP%\vbjhkjkkdsadf99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sv\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\th\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\tr\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\uk\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\vi\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\zh_cn\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\zh_tw\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\fnfhfpkmpnmlmlgfeabpegnfpdnmokco\5.18.6_0\background.html
%TEMP%\vbjhkjkkdsadf99\default\extensions\fnfhfpkmpnmlmlgfeabpegnfpdnmokco\5.18.6_0\icon.png
%TEMP%\vbjhkjkkdsadf99\default\extensions\fnfhfpkmpnmlmlgfeabpegnfpdnmokco\5.18.6_0\manifest.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\fnfhfpkmpnmlmlgfeabpegnfpdnmokco\5.18.6_0\js\aes.js
%TEMP%\vbjhkjkkdsadf99\default\extensions\fnfhfpkmpnmlmlgfeabpegnfpdnmokco\5.18.6_0\js\background.js
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\log
%TEMP%\vbjhkjkkdsadf99\default\extensions\fnfhfpkmpnmlmlgfeabpegnfpdnmokco\5.18.6_0\js\content.js
%TEMP%\vbjhkjkkdsadf99\default\extensions\fnfhfpkmpnmlmlgfeabpegnfpdnmokco\5.18.6_0\js\jquery-3.3.1.min.js
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\5d032f3fd1d77d5e_0
%TEMP%\vbjhkjkkdsadf99\default\extensions\fnfhfpkmpnmlmlgfeabpegnfpdnmokco\5.18.6_0\js\mode-ecb.js
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000001
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\30b9ed8aa5cc7264_0
%TEMP%\vbjhkjkkdsadf99\default\extensions\fnfhfpkmpnmlmlgfeabpegnfpdnmokco\5.18.6_0\js\pad-nopadding.js
%TEMP%\vbjhkjkkdsadf99\default\extensions\fnfhfpkmpnmlmlgfeabpegnfpdnmokco\5.18.6_0\js\srchfeedyoungie.js
%TEMP%\etilqs_ay6b9gwphtdktva
%TEMP%\vbjhkjkkdsadf99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\128.png
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000002
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000003
%TEMP%\vbjhkjkkdsadf99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\manifest.json
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\7d9d00f1008294dc_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\e9334d0e7531016a_0
%TEMP%\vbjhkjkkdsadf99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ar\messages.json
%TEMP%\etilqs_lr9zy3mu6nrctva
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000004
%TEMP%\vbjhkjkkdsadf99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\bg\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ca\messages.json
%TEMP%\bd18.tmp
%TEMP%\vbjhkjkkdsadf99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\cs\messages.json
%TEMP%\etilqs_q4nrg9cxumuyn79
%TEMP%\vbjhkjkkdsadf99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\da\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\de\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\el\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\en\messages.json
%TEMP%\scoped_dir5976_1280112145\crx_install\background.html
%TEMP%\vbjhkjkkdsadf99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\es\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fi\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fil\messages.json
%TEMP%\scoped_dir5976_1280112145\crx_install\css\custom.css
%TEMP%\scoped_dir5976_1280112145\crx_install\img\icon.png
%TEMP%\vbjhkjkkdsadf99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fr\messages.json
%TEMP%\scoped_dir5976_1280112145\crx_install\img\sds.png
%TEMP%\scoped_dir5976_1280112145\crx_install\js\background.js
%TEMP%\vbjhkjkkdsadf99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hi\messages.json
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\bc5899db71d1e387_0
%TEMP%\scoped_dir5976_1280112145\crx_install\js\jquery-3.5.1.js
%TEMP%\vbjhkjkkdsadf99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hr\messages.json
%TEMP%\scoped_dir5976_1280112145\crx_install\js\jquery-3.5.1.min.js
%TEMP%\vbjhkjkkdsadf99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hu\messages.json
%TEMP%\scoped_dir5976_1280112145\crx_install\_locales\en\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\id\messages.json
%TEMP%\scoped_dir5976_1280112145\crx_install\_locales\zh_cn\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\it\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ja\messages.json
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000005
%TEMP%\vbjhkjkkdsadf99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ko\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\lt\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\lv\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\nl\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\no\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pl\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pt_br\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pt_pt\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ro\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ru\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\se\messages.json
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\extension rules\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\extension rules\000001.dbtmp
%TEMP%\vbjhkjkkdsadf99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sk\messages.json
%LOCALAPPDATA%\microsoft\edge\user data\default\extension rules\log
%LOCALAPPDATA%\microsoft\edge\user data\default\extension rules\000003.log
%TEMP%\vbjhkjkkdsadf99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sl\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sr\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\th\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\tr\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\uk\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\vi\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\zh_cn\messages.json
%TEMP%\vbjhkjkkdsadf99\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\zh_tw\messages.json
%TEMP%\d898a8f3-f031-467e-9991-c1e33ffefaae.tmp
%TEMP%\vbjhkjkkdsadf99\default\session storage\current
%TEMP%\vbjhkjkkdsadf99\default\session storage\log
%LOCALAPPDATA%\microsoft\edge\user data\default\quotamanager-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\200c0e78-cdb8-49ac-b996-fec09951adf4\index
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\200c0e78-cdb8-49ac-b996-fec09951adf4\index-dir\temp-index
%LOCALAPPDATA%\microsoft\edge\user data\default\quotamanager
%TEMP%\vbjhkjkkdsadf99\default\session storage\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\7c5882586f3adde3_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\89d89d4431032f20_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\scriptcache\index
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\database\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\database\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\scriptcache\index-dir\temp-index
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\86201093-db9d-433d-b897-6b3760bc2d28\index
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\database\log
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\database\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\86201093-db9d-433d-b897-6b3760bc2d28\index-dir\temp-index
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\1edfe4746e8ac043_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\356cc6f2a8134667_0
%LOCALAPPDATA%\microsoft\edge\user data\default\databases\databases.db-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\ea127fb105244d47_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\6ffd2a529e43d511_0
%LOCALAPPDATA%\microsoft\edge\user data\default\databases\databases.db
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\86201093-db9d-433d-b897-6b3760bc2d28\ee91b116cc2005be_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\1cd05d272ad36863_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\9153941a221fd050_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\422062979cccfa2a_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\scriptcache\2cc80dabc69f58b6_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\daf44f4f345dba59_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000006
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000007
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000008
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\scriptcache\2cc80dabc69f58b6_1
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\c6e9437544cbdf07_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\index
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\index-dir\temp-index
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\bf1de41291fbfeee_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000009
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\125af4bbd790dbdb_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\3108ea344c5f0db7_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\2808bc2ac0fc3e04_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\afd108def30c496c_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\afd108def30c496c_1
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\bc55d08e98ab3f57_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000a
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\c5256ea81a878c4d_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\a76eeae60ed4ae69_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\51f56a2f36b80855_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\8ae53681734e26f0_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\ea9d867a324e6b83_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\8ae53681734e26f0_1
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\edff57de816b7305_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\ebd74773ef64bcf3_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\be8f4e520a408666_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\ebd74773ef64bcf3_1
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000b
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\a4a6029e2121b32c_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\a4a6029e2121b32c_1
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\5e6e7b3a2d04198b_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\5e6e7b3a2d04198b_1
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\127497ae852a78d0_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\127497ae852a78d0_1
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\4cd2c21683b0d1ed_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\4cd2c21683b0d1ed_1
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\35b091126c8ed094_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\35b091126c8ed094_1
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\1ae99b9d1023abc6_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\1ae99b9d1023abc6_1
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\355935c6336c40b8_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\355935c6336c40b8_1
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000004
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\d538f59b1df4a07e_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\d538f59b1df4a07e_1
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000004.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts
%LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\5f55ec58b17539d8_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\5f55ec58b17539d8_1
%LOCALAPPDATA%\microsoft\edge\user data\last browser
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000c
%LOCALAPPDATA%\microsoft\edge\user data\default\preferredapps
%LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\bb00b61830fd23ca_0
%LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\log
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\bb00b61830fd23ca_1
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\log
%TEMP%\vbjhkjkkdsadf99\default\cae.tmp
%TEMP%\vbjhkjkkdsadf99\default\shortcuts-journal
%TEMP%\etilqs_uo9wvulxblnad0o
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\00f6e2572d10798e_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\00f6e2572d10798e_1
%TEMP%\1048.tmp
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\03defd8db4aff0bf_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\03defd8db4aff0bf_1
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\0ed0200b05f971cf_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\0ed0200b05f971cf_1
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\efa1df8869c6a026_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\efa1df8869c6a026_1
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\cc8ea47d02e93fa3_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\cc8ea47d02e93fa3_1
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\log
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000d
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\d8f32670da446f9e_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\d8f32670da446f9e_1
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000e
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\76322bd271ad9aa7_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\76322bd271ad9aa7_1
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\63964d28298a2524_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\63964d28298a2524_1
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\0136c59cd369aa1c_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\0136c59cd369aa1c_1
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000f
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\d0ddd807c824b39a_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\d0ddd807c824b39a_1
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\27e3071043d5de4d_0
%TEMP%\vbjhkjkkdsadf99\32a6.tmp
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\27e3071043d5de4d_1
%TEMP%\vbjhkjkkdsadf99\default\3344.tmp
%TEMP%\vbjhkjkkdsadf99\default\3393.tmp
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\8cb9232d956e26b4_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\8cb9232d956e26b4_1
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000010
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\b6b3838d3ce0d4a1_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\b6b3838d3ce0d4a1_1
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\165a7900089a4d28_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\165a7900089a4d28_1
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\4c949ad6daa77aa3_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\4c949ad6daa77aa3_1
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\22b2e11c61535bf5_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\22b2e11c61535bf5_1
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\2e21be76bcc58ee7_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\2e21be76bcc58ee7_1
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\4f799c90fce43d5c_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\4f799c90fce43d5c_1
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000011
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\50ca8cba7946920a_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\50ca8cba7946920a_1
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\9d40c9cc6f7740a3_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\9d40c9cc6f7740a3_1
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\8e10a61e4d09b22d_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\8e10a61e4d09b22d_1
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\366fb574b83ef666_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\366fb574b83ef666_1
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\013f73f81524b1ab_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\013f73f81524b1ab_1
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\824854aacb71709d_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\824854aacb71709d_1
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\a645ba6ecd51906c_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\a645ba6ecd51906c_1
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\eb775ce2eb645397_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\eb775ce2eb645397_1
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000012
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\c4ea4cbc7fe40886_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\c4ea4cbc7fe40886_1
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\6e7038cfe8fd7a10_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\6e7038cfe8fd7a10_1
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\f0ce427b28da7d25_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\34d467f947acad13_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\872b7b4f8bfb485b_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\f7a02825bf690a95_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\65f701fc2d3b6d77_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\960aaafa77fbb8a0_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\b849a2f19789767a_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\67f1189172319be9_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\e6504c209cb882d7_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\df9f3044c9ae2e2e_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\3055e34b33d94a7f_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\ea6f02895a4e3500_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\7c4863577c43b32f_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\574b540795aeca12_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\9edf5f432f2b01a8_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\2a15b98971354678_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\0a67355f432340b9_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\b9dcc9f4c807eeaa_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\321e64ecacb66619_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\153bba9a429a2c40_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\2e08a9c6ec333021_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\39c763e560200cda_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\6dcb70bdb8fe40a3_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\7ed93a10144ac834_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\264b46d61d915def_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\b7cd751a99c70c48_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\13e83bd1c1ab1541_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\8fdcb7992c9e741c_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\ff5222d57552b6c1_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\b87cf2f2b0511c4c_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\index-dir\temp-index
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\dd1d9f7425e5aefb_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\348aae4f13c8f553_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\8cce886514f2b2ec_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\217bbc87393d2e57_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\8bfc77f05f6a3cc5_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\2a99e21c738e2a0b_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\d6af3918ca46ca94_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\85f220494be669b7_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\2bb582fd7577f97e_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\9f97c8dd99a7773d_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\ed344a77138c223d_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\95fcbb4ef0998598_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\5e44a7f4adb70c29_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\c95d30c9d70f69cd_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\b6a609a2a4d72ee3_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\3881c13d201c7aa8_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\b1eb612d97acde28_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\ab8e5be042409c8f_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\a35caf37911ffc68_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\a674423cfbfd17cb_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\3b03edf631539a03_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\7b242180316745f3_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\f12d9bd42964b0e9_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\a4eeb911b4b433aa_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\22d4a57ac4e23ec3_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\8c2129e90010758d_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\383a36fceaa62055_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\9e8aa4fdf814d5ed_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\3baf6e1cdce96d35_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\f1b076f89f1cca1b_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\b4f84b300748a114_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\5c14882e51891d25_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\79f151d882f08df2_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\4fce287b5b441d74_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\10321e9873897921_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\040f11e49243b61d_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\a4f8d2c06f10a58b_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\dc4038e735155772_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\2ccec3ded4220927_0
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\37dc59fa0fdce3a3_0
%TEMP%\vbjhkjkkdsadf99\default\5a65.tmp
%LOCALAPPDATA%\microsoft\edge\user data\functional data-wal
%LOCALAPPDATA%\microsoft\edge\user data\functional san data-wal
%TEMP%\vbjhkjkkdsadf99\6e00.tmp
%TEMP%\vbjhkjkkdsadf99\default\8f64.tmp

Deletes following files that it created itself

%WINDIR%\syswow64\windowspowershell\v1.0\d
%WINDIR%\syswow64\windowspowershell\v1.0\d-shm
%TEMP%\is-1mgud.tmp\idp.dll
%TEMP%\is-1mgud.tmp\_isetup\_setup64.tmp
%TEMP%\jfiag3g_gg.exe
%TEMP%\fj4ghga23_fsa.txt
%TEMP%\is-jpm7k.tmp\file.tmp
%WINDIR%\syswow64\windowspowershell\v1.0\d.integ.raw
%WINDIR%\syswow64\windowspowershell\v1.0\d.jfm
%TEMP%\ecv5852.tmp
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\icatrn1b\error[1]
%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
%TEMP%\af12d253-0618-47ac-8f6e-7712756d6ab3.tmp
%TEMP%\bd18.tmp
%TEMP%\scoped_dir5976_1280112145\crx_install\img\icon.png
%TEMP%\scoped_dir5976_1280112145\crx_install\_locales\en\messages.json
%TEMP%\scoped_dir5976_1280112145\crx_install\_locales\zh_cn\messages.json
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-693dc193-ed4.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-693dc19d-1758.pma
%TEMP%\scoped_dir5976_1280112145\plugins-edge.crx
%TEMP%\vbjhkjkkdsadf99\default\cae.tmp
%TEMP%\1048.tmp
%TEMP%\vbjhkjkkdsadf99\default\history provider cache
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\30b9ed8aa5cc7264_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\7d9d00f1008294dc_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\bc5899db71d1e387_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\e9334d0e7531016a_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\7c5882586f3adde3_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\422062979cccfa2a_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\51f56a2f36b80855_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\1edfe4746e8ac043_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\daf44f4f345dba59_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\9153941a221fd050_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\c6e9437544cbdf07_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\bc55d08e98ab3f57_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\3108ea344c5f0db7_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\edff57de816b7305_0

Moves the following files

from %LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\extension rules\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\extension rules\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\200c0e78-cdb8-49ac-b996-fec09951adf4\index-dir\temp-index to %LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\200c0e78-cdb8-49ac-b996-fec09951adf4\index-dir\the-real-index
from %LOCALAPPDATA%\microsoft\edge\user data\default\service worker\scriptcache\index-dir\temp-index to %LOCALAPPDATA%\microsoft\edge\user data\default\service worker\scriptcache\index-dir\the-real-index
from %LOCALAPPDATA%\microsoft\edge\user data\default\service worker\database\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\service worker\database\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\86201093-db9d-433d-b897-6b3760bc2d28\index-dir\temp-index to %LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\86201093-db9d-433d-b897-6b3760bc2d28\index-dir\the-real-index
from %LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\index-dir\temp-index to %LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0de5dd3b-1c4d-4157-bbac-7bca9726cd22\index-dir\the-real-index
from %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\current
from %TEMP%\vbjhkjkkdsadf99\default\data_reduction_proxy_leveldb\log to %TEMP%\vbjhkjkkdsadf99\default\data_reduction_proxy_leveldb\log.old
from %TEMP%\vbjhkjkkdsadf99\default\current session to %TEMP%\vbjhkjkkdsadf99\default\last session
from %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\current
from %TEMP%\vbjhkjkkdsadf99\default\extension state\log to %TEMP%\vbjhkjkkdsadf99\default\extension state\log.old
from %TEMP%\vbjhkjkkdsadf99\32a6.tmp to %TEMP%\vbjhkjkkdsadf99\local state
from %TEMP%\vbjhkjkkdsadf99\default\3344.tmp to %TEMP%\vbjhkjkkdsadf99\default\secure preferences
from %TEMP%\vbjhkjkkdsadf99\default\3393.tmp to %TEMP%\vbjhkjkkdsadf99\default\preferences
from %TEMP%\vbjhkjkkdsadf99\default\5a65.tmp to %TEMP%\vbjhkjkkdsadf99\default\secure preferences
from %TEMP%\vbjhkjkkdsadf99\6e00.tmp to %TEMP%\vbjhkjkkdsadf99\local state
from %TEMP%\vbjhkjkkdsadf99\default\8f64.tmp to %TEMP%\vbjhkjkkdsadf99\default\secure preferences
from %TEMP%\vbjhkjkkdsadf99\default\session storage\log to %TEMP%\vbjhkjkkdsadf99\default\session storage\log.old

Modifies the following files

%LOCALAPPDATA%\microsoft\penworkspace\discovercachedata.dat
%LOCALAPPDATA%\google\chrome\user data\default\secure preferences
%LOCALAPPDATA%\microsoft\edge\user data\last version
%LOCALAPPDATA%\microsoft\edge\user data\default\site characteristics database\log
%LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\web data-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\web data
%LOCALAPPDATA%\microsoft\edge\user data\default\visited links
%LOCALAPPDATA%\microsoft\edge\user data\default\history-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\favicons-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\history
%LOCALAPPDATA%\microsoft\edge\user data\default\local storage\leveldb\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\favicons
%LOCALAPPDATA%\microsoft\tokenbroker\cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
%TEMP%\.ses

Substitutes the following files

%WINDIR%\syswow64\windowspowershell\v1.0\d
%TEMP%\jfiag3g_gg.exe
%TEMP%\fj4ghga23_fsa.txt
%WINDIR%\syswow64\windowspowershell\v1.0\d.integ.raw
%WINDIR%\syswow64\windowspowershell\v1.0\d.jfm
%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Platform Notifications\LOG
%TEMP%\scoped_dir5976_1280112145\crx_install\img\icon.png
%TEMP%\scoped_dir5976_1280112145\crx_install\_locales\en\messages.json
%TEMP%\scoped_dir5976_1280112145\crx_install\_locales\zh_cn\messages.json
%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\LOG
%TEMP%\vbjhkjkkdsadf99\default\data_reduction_proxy_leveldb\log
%TEMP%\vbjhkjkkdsadf99\default\current session
%TEMP%\vbjhkjkkdsadf99\default\extension state\log
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\86201093-db9d-433d-b897-6b3760bc2d28\index-dir\temp-index
%LOCALAPPDATA%\microsoft\edge\user data\default\service worker\scriptcache\index-dir\temp-index
%WINDIR%\syswow64\windowspowershell\v1.0\d-shm

Network activity

Connects to

'10#.#6.107.74':80
'ip##pi.com':80
'ip###ger.org':443
'fa###ook.com':443
'ue#####6gh.2ihsfa.com':80
'ge#.#eojs.io':443
'13#.#80.207.31':8080
'co####.edge.skype.com':443
'sb.#####cardresearch.com':443
'im######n-com.akamaized.net':443
'google.com':443
'tr######e.googleapis.com':443
'ss#.#static.com':443
'r.####static.com':443
'13#.#80.207.31':8070
'clients2.google.com':443
'se####.facebook.com':443

TCP

HTTP GET requests

http://ip##pi.com/json/
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?cb##############

HTTP POST requests

Other

'ip###ger.org':443
'fa###ook.com':443
'ge#.#eojs.io':443
'co####.edge.skype.com':443
'sb.#####cardresearch.com':443
'im######n-com.akamaized.net':443
'google.com':443
'clients2.google.com':443
'tr######e.googleapis.com':443
'ss#.#static.com':443
'r.####static.com':443
'se####.facebook.com':443

UDP

DNS ASK ip##de.pw
DNS ASK ip##pi.com
DNS ASK ip###ger.org
DNS ASK mo####center.xyz
DNS ASK ws####3sdfer.com
DNS ASK fa###ook.com
DNS ASK so#####nstallation.com
DNS ASK ue#####6gh.2ihsfa.com
DNS ASK ge#.#eojs.io
DNS ASK co####.edge.skype.com
DNS ASK google.com
DNS ASK im######n-com.akamaized.net
DNS ASK sb.#####cardresearch.com
DNS ASK clients2.google.com
DNS ASK clients3.google.com
DNS ASK tr######e.googleapis.com
DNS ASK clients4.google.com
DNS ASK ss#.#static.com
DNS ASK uk###sw19x.com
DNS ASK r.####static.com
DNS ASK fd##ice.pw
DNS ASK se####.facebook.com

Miscellaneous

Searches for the following windows

ClassName: 'EDIT' WindowName: ''
ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Microsoft\Edge\User Data'
ClassName: 'RegEdit_RegEdit' WindowName: ''
ClassName: '' WindowName: ''
ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebCheckMonitor' WindowName: ''
ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Google\Chrome\User Data'
ClassName: 'Chrome_MessageWindow' WindowName: '%TEMP%\vbjhkjkkdsadf99'

Creates and executes the following

'%WINDIR%\syswow64\windowspowershell\v1.0\krsetp.exe'
'%WINDIR%\syswow64\windowspowershell\v1.0\jg7_7wjg.exe'
'%WINDIR%\syswow64\windowspowershell\v1.0\ubisoftant.exe'
'%WINDIR%\syswow64\windowspowershell\v1.0\askinstall4.exe'
'%WINDIR%\syswow64\windowspowershell\v1.0\piyyy.exe'
'%WINDIR%\syswow64\windowspowershell\v1.0\file.exe'
'%WINDIR%\syswow64\windowspowershell\v1.0\customer2.exe'
'%WINDIR%\syswow64\windowspowershell\v1.0\setup.exe'
'%TEMP%\jfiag3g_gg.exe' /scookiestxt %TEMP%\fj4ghga23_fsa.txt
'%TEMP%\is-jpm7k.tmp\file.tmp' /SL5="$201DE,869946,780288,%WINDIR%\SysWOW64\WindowsPowerShell\v1.0\file.exe"
'%TEMP%\rarsfx0\main.exe'
'%WINDIR%\syswow64\windowspowershell\v1.0\file.exe' /VERYSILENT
'%TEMP%\is-ha3p1.tmp\file.tmp' /SL5="$502A4,869946,780288,%WINDIR%\SysWOW64\WindowsPowerShell\v1.0\file.exe" /VERYSILENT
'%WINDIR%\syswow64\windowspowershell\v1.0\ubisoftant.exe' /RestartByRestartManager:2924FCEC-5AB8-466d-9E73-070691E518EC

Executes the following

'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://iplogger.org/1wNij7
'%WINDIR%\syswow64\cmd.exe' /C ping 1.#.1.1 -n 1 -w 3000 > Nul & Del /f /q "%WINDIR%\SysWOW64\WindowsPowerShell\v1.0\setup.exe"
'%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im chrome.exe
'%WINDIR%\regedit.exe' /s chrome.reg
'%WINDIR%\syswow64\ping.exe' 1.#.1.1 -n 1 -w 3000
'<SYSTEM32>\cmd.exe' /c chrome7.bat
'<SYSTEM32>\mshta.exe' vbscript:createobject("wscript.shell").run("chrome7.bat h",0)(window.close)
'%WINDIR%\syswow64\xcopy.exe' "%LOCALAPPDATA%\Google\Chrome\User Data" "%TEMP%\vbjhkjkkdsadf99\" /s /e /y
'%WINDIR%\regedit.exe' /s chrome-set.reg
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\RarSFX0\chrome7.bat" h"
'%WINDIR%\regedit.exe' /s edge.reg
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate https://iplogger.org/1wNij7
'<SYSTEM32>\cmd.exe' /c edge86.bat
'<SYSTEM32>\mshta.exe' vbscript:createobject("wscript.shell").run("edge86.bat h",0)(window.close)
'%WINDIR%\regedit.exe' /s edge-set.reg
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\RarSFX0\edge86.bat" h"
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe'
'%ProgramFiles(x86)%\microsoft\edge\application\89.0.774.68\identity_helper.exe' --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1840,4876349069709806190,11477931895458300068,131072 --lang=en-US --service-sandbox-type=none --mojo-...
'%TEMP%\jfiag3g_gg.exe' /scookiestxt %TEMP%\fj4ghga23_fsa.txt' (with hidden window)
'<SYSTEM32>\taskkill.exe' /F /IM chrome.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im chrome.exe' (with hidden window)
'%WINDIR%\regedit.exe' /s chrome.reg' (with hidden window)
'<SYSTEM32>\cmd.exe' /c chrome7.bat' (with hidden window)
'%WINDIR%\regedit.exe' /s chrome-set.reg' (with hidden window)
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\RarSFX0\chrome7.bat" h"' (with hidden window)
'%WINDIR%\regedit.exe' /s edge.reg' (with hidden window)
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate https://iplogger.org/1wNij7' (with hidden window)
'<SYSTEM32>\cmd.exe' /c edge86.bat' (with hidden window)
'%WINDIR%\regedit.exe' /s edge-set.reg' (with hidden window)
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\RarSFX0\edge86.bat" h"' (with hidden window)

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial