daecc9320516c2a2d9cf480a0b49a5d1a7c9c1eba75b67fa486c33d23b065dd4

Analysis

max time kernel
150s
max time network
152s
platform
windows10_x64
resource
win10v20201028
submitted
13-01-2021 13:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Alpha Square Group Proposal.pdf
Size

48KB
MD5

27972b779e0517eab11c5c0c4f873142
SHA1

6aece224e378c14979de9f70abdb9de81b0d30e7
SHA256

daecc9320516c2a2d9cf480a0b49a5d1a7c9c1eba75b67fa486c33d23b065dd4
SHA512

fd6146f28fe16f34689e3ec0d1a74c10a15ae483dab6adb4691bba56b24991aff44b60056f727aa3f5e81ea43395053b1d04216ce7e6cc4eb5123299d319ef56

Score

6^/10

Malware Config

Signatures

JavaScript code in executable 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7020X8P0\AQNW2RY1.js	js
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\TUW7O93N\main[1].js	js

Drops file in Windows directory 2 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdge.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exeAcroRd32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies Control Panel 2 IoCs

evasion

Processes:

MicrosoftEdge.exeMicrosoftEdge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\Colors	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\Colors	MicrosoftEdge.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exeMicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exebrowser_broker.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 356 IoCs

Processes:

MicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionI	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = b537844cade9d601	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DomStorageState	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = 010000002ab6e04744a465fb700467fae75c62800ae461b69baabe89f942060895b5c55a49a984951bebbc370fd130554a1b34bfa549718f459a68b2f714c51bae60247c0d491307732bc99dc5b11a43719a1fa2336cf0b458522c57b98bca67691ce17f00b6a580b803bced8dc602405f7adb83a66b3ca8d173064750c74581d3883d9e4a105d6de51545a114310a5a875bc0f42e68ced4399e4de671e8c74e1c4617ee53770a388300af85271087ed99dd5e08858189aee4716ecbd30d1f2d67f5e8ed6d0b3b93986425e09384e32cb1a0f4ae7fd8e7a44f8e8fef8558da64fa34f92f53ec1391dfe19c24aeadce02ba44141f878b7ce07193906c70e8e1eb73a583076a3ae98d8517ac3d34ac1ebd536a68523ebc0bd4e32184c917ddda7d6ce7f04d5c1521e604a60b5f1b9f5fd52cb0cd8cbb892fa232d926dc6157a1fca099a031459d9c80682edb73b7a7f6bc16b735fa3d141844fd593c35ba758b28185d691ea4f2bc26724f740b41e54bf9e41fcf57837b549474435820e259cea261d2a4a8f9343fac50a9bae637774c94ba8858ad6ce0c6167735b9302276f330f8b82ddde4b449cd3eb8	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = f7d5814cade9d601	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DomStorageState\EdpCleanupState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\www.bing.com\ = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingDelete\C:\Users\Admin\AppData\Local\Packa = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 8aeeaf4eade9d601	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\MigrationTime = 6c3a3b6c55add601	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\LastClosedWidth = "800"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IntelliForms	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = 010000003046ab94328c59933286f0b34534765af05575f3e66c77520fb462089d3afc3af9928dfed9c56f583c79f6f8590f4f9d784820297a61bb33a57d	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B72164 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B72164 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\Total = "3134"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingDelete	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\Total = "23"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\OneBoxLoadAttempts = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\ClearBrowsingHistoryOnStart = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = 01000000b3d9f09cab9d40b0dded43f27429d2fd63f20e568f2392cd18ec8bd37c7e84745b03994fb0c050c0a3a4797488c713b9eee6eda526f4da9fb22f	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings	MicrosoftEdge.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

AcroRd32.exe

pid	process
3108	AcroRd32.exe
3108	AcroRd32.exe
3108	AcroRd32.exe
3108	AcroRd32.exe
3108	AcroRd32.exe
3108	AcroRd32.exe
3108	AcroRd32.exe
3108	AcroRd32.exe
3108	AcroRd32.exe
3108	AcroRd32.exe
3108	AcroRd32.exe
3108	AcroRd32.exe
3108	AcroRd32.exe
3108	AcroRd32.exe
3108	AcroRd32.exe
3108	AcroRd32.exe
3108	AcroRd32.exe
3108	AcroRd32.exe
3108	AcroRd32.exe
3108	AcroRd32.exe

Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

MicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

pid process

4780 MicrosoftEdgeCP.exe
4780 MicrosoftEdgeCP.exe
5000 MicrosoftEdgeCP.exe
5000 MicrosoftEdgeCP.exe
5000 MicrosoftEdgeCP.exe
5000 MicrosoftEdgeCP.exe

pid	process
4780	MicrosoftEdgeCP.exe
4780	MicrosoftEdgeCP.exe
5000	MicrosoftEdgeCP.exe
5000	MicrosoftEdgeCP.exe
5000	MicrosoftEdgeCP.exe
5000	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exefirefox.exe

description	pid	process
Token: SeDebugPrivilege	4368	MicrosoftEdge.exe
Token: SeDebugPrivilege	4368	MicrosoftEdge.exe
Token: SeDebugPrivilege	4368	MicrosoftEdge.exe
Token: SeDebugPrivilege	4368	MicrosoftEdge.exe
Token: SeDebugPrivilege	4848	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4848	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4848	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4848	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4368	MicrosoftEdge.exe
Token: SeDebugPrivilege	4848	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4848	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4596	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4596	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4596	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4596	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	5380	firefox.exe
Token: SeDebugPrivilege	5380	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

Processes:

AcroRd32.exefirefox.exe

pid process

3108 AcroRd32.exe
5380 firefox.exe
5380 firefox.exe
5380 firefox.exe
5380 firefox.exe
5380 firefox.exe
5380 firefox.exe

Suspicious use of SendNotifyMessage 14 IoCs

Processes:

AcroRd32.exefirefox.exe

pid	process
3108	AcroRd32.exe
3108	AcroRd32.exe
3108	AcroRd32.exe
3108	AcroRd32.exe
3108	AcroRd32.exe
3108	AcroRd32.exe
3108	AcroRd32.exe
3108	AcroRd32.exe
3108	AcroRd32.exe
5380	firefox.exe
5380	firefox.exe
5380	firefox.exe
5380	firefox.exe
5380	firefox.exe

Suspicious use of SetWindowsHookEx 17 IoCs

Processes:

AcroRd32.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exefirefox.exe

pid	process
3108	AcroRd32.exe
3108	AcroRd32.exe
3108	AcroRd32.exe
3108	AcroRd32.exe
3108	AcroRd32.exe
4368	MicrosoftEdge.exe
4780	MicrosoftEdgeCP.exe
4780	MicrosoftEdgeCP.exe
3108	AcroRd32.exe
556	MicrosoftEdge.exe
5000	MicrosoftEdgeCP.exe
5000	MicrosoftEdgeCP.exe
4596	MicrosoftEdgeCP.exe
5380	firefox.exe
5380	firefox.exe
5380	firefox.exe
5380	firefox.exe

Suspicious use of WriteProcessMemory 411 IoCs

Processes:

AcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 3108 wrote to memory of 424	3108	AcroRd32.exe	RdrCEF.exe
PID 3108 wrote to memory of 424	3108	AcroRd32.exe	RdrCEF.exe
PID 3108 wrote to memory of 424	3108	AcroRd32.exe	RdrCEF.exe
PID 3108 wrote to memory of 3212	3108	AcroRd32.exe	LaunchWinApp.exe
PID 3108 wrote to memory of 3212	3108	AcroRd32.exe	LaunchWinApp.exe
PID 3108 wrote to memory of 3212	3108	AcroRd32.exe	LaunchWinApp.exe
PID 424 wrote to memory of 2344	424	RdrCEF.exe	RdrCEF.exe
PID 424 wrote to memory of 2344	424	RdrCEF.exe	RdrCEF.exe
PID 424 wrote to memory of 2344	424	RdrCEF.exe	RdrCEF.exe
PID 424 wrote to memory of 2344	424	RdrCEF.exe	RdrCEF.exe
PID 424 wrote to memory of 2344	424	RdrCEF.exe	RdrCEF.exe
PID 424 wrote to memory of 2344	424	RdrCEF.exe	RdrCEF.exe
PID 424 wrote to memory of 2344	424	RdrCEF.exe	RdrCEF.exe
PID 424 wrote to memory of 2344	424	RdrCEF.exe	RdrCEF.exe
PID 424 wrote to memory of 2344	424	RdrCEF.exe	RdrCEF.exe
PID 424 wrote to memory of 2344	424	RdrCEF.exe	RdrCEF.exe
PID 424 wrote to memory of 2344	424	RdrCEF.exe	RdrCEF.exe
PID 424 wrote to memory of 2344	424	RdrCEF.exe	RdrCEF.exe
PID 424 wrote to memory of 2344	424	RdrCEF.exe	RdrCEF.exe
PID 424 wrote to memory of 2344	424	RdrCEF.exe	RdrCEF.exe
PID 424 wrote to memory of 2344	424	RdrCEF.exe	RdrCEF.exe
PID 424 wrote to memory of 2344	424	RdrCEF.exe	RdrCEF.exe
PID 424 wrote to memory of 2344	424	RdrCEF.exe	RdrCEF.exe
PID 424 wrote to memory of 2344	424	RdrCEF.exe	RdrCEF.exe
PID 424 wrote to memory of 2344	424	RdrCEF.exe	RdrCEF.exe
PID 424 wrote to memory of 2344	424	RdrCEF.exe	RdrCEF.exe
PID 424 wrote to memory of 2344	424	RdrCEF.exe	RdrCEF.exe
PID 424 wrote to memory of 2344	424	RdrCEF.exe	RdrCEF.exe
PID 424 wrote to memory of 2344	424	RdrCEF.exe	RdrCEF.exe
PID 424 wrote to memory of 2344	424	RdrCEF.exe	RdrCEF.exe
PID 424 wrote to memory of 2344	424	RdrCEF.exe	RdrCEF.exe
PID 424 wrote to memory of 2344	424	RdrCEF.exe	RdrCEF.exe
PID 424 wrote to memory of 2344	424	RdrCEF.exe	RdrCEF.exe
PID 424 wrote to memory of 2344	424	RdrCEF.exe	RdrCEF.exe
PID 424 wrote to memory of 2344	424	RdrCEF.exe	RdrCEF.exe
PID 424 wrote to memory of 2344	424	RdrCEF.exe	RdrCEF.exe
PID 424 wrote to memory of 2344	424	RdrCEF.exe	RdrCEF.exe
PID 424 wrote to memory of 2344	424	RdrCEF.exe	RdrCEF.exe
PID 424 wrote to memory of 2344	424	RdrCEF.exe	RdrCEF.exe
PID 424 wrote to memory of 2344	424	RdrCEF.exe	RdrCEF.exe
PID 424 wrote to memory of 2344	424	RdrCEF.exe	RdrCEF.exe
PID 424 wrote to memory of 2344	424	RdrCEF.exe	RdrCEF.exe
PID 424 wrote to memory of 2344	424	RdrCEF.exe	RdrCEF.exe
PID 424 wrote to memory of 2344	424	RdrCEF.exe	RdrCEF.exe
PID 424 wrote to memory of 2344	424	RdrCEF.exe	RdrCEF.exe
PID 424 wrote to memory of 2344	424	RdrCEF.exe	RdrCEF.exe
PID 424 wrote to memory of 2344	424	RdrCEF.exe	RdrCEF.exe
PID 424 wrote to memory of 3912	424	RdrCEF.exe	RdrCEF.exe
PID 424 wrote to memory of 3912	424	RdrCEF.exe	RdrCEF.exe
PID 424 wrote to memory of 3912	424	RdrCEF.exe	RdrCEF.exe
PID 424 wrote to memory of 3912	424	RdrCEF.exe	RdrCEF.exe
PID 424 wrote to memory of 3912	424	RdrCEF.exe	RdrCEF.exe
PID 424 wrote to memory of 3912	424	RdrCEF.exe	RdrCEF.exe
PID 424 wrote to memory of 3912	424	RdrCEF.exe	RdrCEF.exe
PID 424 wrote to memory of 3912	424	RdrCEF.exe	RdrCEF.exe
PID 424 wrote to memory of 3912	424	RdrCEF.exe	RdrCEF.exe
PID 424 wrote to memory of 3912	424	RdrCEF.exe	RdrCEF.exe
PID 424 wrote to memory of 3912	424	RdrCEF.exe	RdrCEF.exe
PID 424 wrote to memory of 3912	424	RdrCEF.exe	RdrCEF.exe
PID 424 wrote to memory of 3912	424	RdrCEF.exe	RdrCEF.exe
PID 424 wrote to memory of 3912	424	RdrCEF.exe	RdrCEF.exe
PID 424 wrote to memory of 3912	424	RdrCEF.exe	RdrCEF.exe
PID 424 wrote to memory of 3912	424	RdrCEF.exe	RdrCEF.exe
PID 424 wrote to memory of 3912	424	RdrCEF.exe	RdrCEF.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Alpha Square Group Proposal.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3108

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
- Suspicious use of WriteProcessMemory
PID:424

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=01507C205DD2FAB58A99B278B06BDC6E --mojo-platform-channel-handle=1628 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:2344

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=1303202F0A353E3775FADDF205B84D85 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=1303202F0A353E3775FADDF205B84D85 --renderer-client-id=2 --mojo-platform-channel-handle=1652 --allow-no-sandbox-job /prefetch:1
3⤵
PID:3912

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=BDFECC5A9377B0BBC6486C3FAC58E6DF --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=BDFECC5A9377B0BBC6486C3FAC58E6DF --renderer-client-id=4 --mojo-platform-channel-handle=2088 --allow-no-sandbox-job /prefetch:1
3⤵
PID:4060

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=1587FD8CE44537FCEE2331717A2EE89A --mojo-platform-channel-handle=2456 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4240

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=48ACDDE19AC21862245F1EB4039E8DA4 --mojo-platform-channel-handle=2560 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4420

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=8D5EB44A0D2E3B18F37C331CC43861D4 --mojo-platform-channel-handle=1908 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4936

C:\Windows\SysWOW64\LaunchWinApp.exe
"C:\Windows\system32\LaunchWinApp.exe" "https://appangelservices1482.myportfolio.com/"
2⤵
PID:3212

C:\Windows\SysWOW64\LaunchWinApp.exe
"C:\Windows\system32\LaunchWinApp.exe" "https://appangelservices1482.myportfolio.com/"
2⤵
PID:4636

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4368

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4440

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:4780

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4848

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:556

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4952

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:5000

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5068

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4848

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4596

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:564

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:2012

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4564

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:5316

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5380

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5380.0.1402493727\1044286302" -parentBuildID 20200403170909 -prefsHandle 1524 -prefMapHandle 1496 -prefsLen 1 -prefMapSize 219511 -appdir "C:\Program Files\Mozilla Firefox\browser" - 5380 "\\.\pipe\gecko-crash-server-pipe.5380" 1616 gpu
3⤵
PID:5584

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5380.3.1119721361\1775775932" -childID 1 -isForBrowser -prefsHandle 1424 -prefMapHandle 1420 -prefsLen 156 -prefMapSize 219511 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 5380 "\\.\pipe\gecko-crash-server-pipe.5380" 2260 tab
3⤵
PID:5692

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5380.13.290094391\272871746" -childID 2 -isForBrowser -prefsHandle 3336 -prefMapHandle 3300 -prefsLen 7013 -prefMapSize 219511 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 5380 "\\.\pipe\gecko-crash-server-pipe.5380" 3348 tab
3⤵
PID:5876

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5380.20.1031714581\1173037039" -childID 3 -isForBrowser -prefsHandle 2020 -prefMapHandle 4108 -prefsLen 8168 -prefMapSize 219511 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 5380 "\\.\pipe\gecko-crash-server-pipe.5380" 2024 tab
3⤵
PID:5220

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7020X8P0\AQNW2RY1.js
MD5
6c71af37b25e862e1671efbd6184cd45

SHA1
d540296e74d7ce2b10794587f2e2e32cf43bc2ce

SHA256
95622a0a23d19d4082bc44b65cb9c40b4a012f4e4b06f6d3af7ee041443f51a0

SHA512
af31c66f709ad690c6cff85a7ddd42e3a0886a658dcba8695d502555d1c0ed96274e202cf42a1be3c14d9ef638e6fb2ae308254d5df24eb6612f29e861a5099b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\CTAL2INZ\cfeff313e9fcf01c36af09a5e9e6cfb11610384708[1].css
MD5
6760db556b89a1c42266e676e747cf8d

SHA1
2286a1a7ab6473931ad2ad12f09f797e830986c0

SHA256
7db89980ce2eb72b7d2c7838aaae7d65b07a2c55bf21d5bb53233208acd9ecb4

SHA512
b79e986788c58545af5ef130c1657cb4e01844df2ce12ceddacdaeba7f4e17b8725c9cbc728f561021c7f60398f059b9b78c44a0b756e662ffe2be34c02c776d

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\TUW7O93N\3e395b33-ca5a-475d-8bb4-e101881af30e_rwc_0x0x2798x1586x4096[1].png
MD5
e3baa9ab593c7c5891ae41686fd9fb89

SHA1
14ccbbfaefd3245bc0f2bc82d06ce4159919043c

SHA256
b6e0d68e41d387d5ff252e210d6ee7985ab2a6f337cb9f8574bea649e774dda0

SHA512
fda4ead7f857036765fe09cb3b472dae455489923b6abf15b71e2d85ebcc178f0dac9bb47608e659b28b79ac6bc093922fb0d20b53b57eea92ab4576991ca3a0

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\TUW7O93N\main[1].css
MD5
c2ca4403cd337d44981dcc6f4df8a21a

SHA1
a72ac2384af4ad64e7d7d3732ee6c351d3ba4c8d

SHA256
009a029a1fbe7ec1821f8884761847d0c4857770dc9aefe51c13ff36c9ac6fd2

SHA512
750822cb33c9ad4b3fd0ca04c8bfb37e95c8d668d2d3e9d38b5fdc95a8b8b5ab9193e1109ddebfa7d9a250b842d1d35f50a942b22e143fcc7a1597d211b6dd9b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\TUW7O93N\main[1].js
MD5
728ed8017c8b273bba3f93026f306747

SHA1
e07fa5d622752f08691c0dcb98406a0507d66ef6

SHA256
eb0ba112ec6ce15524c04901ba1d01041ef89a230e3456aab725e3a2e027776e

SHA512
5fead3be693f286806260fb36c068a0bc814eff3d3b399b0ba497cf6204f3fc435c22eb0d371f425505f9d8d3827085e5e971f8048ef99147e3d8513da7a7ad6

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\YHWNK3K2\XNG8FXIW.htm
MD5
c1f8b9bdc664ddc08cb12ca291bec536

SHA1
0963fa25a2fc9202640fab5ec84fbfd7d84d9513

SHA256
c5340d6adab41bef98372f75347937c7ace578cf851f753c3ea2ea8d73811c64

SHA512
0a4a1cb743cc54dbab505eed58cec3f2b43ddae5b45d3944b3b5dde21862b892b492e4281cb4bdf28d99085c02ca8ea3329c9513baeab2e9e368844e3fcd696e

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\YHWNK3K2\translations[1].js
MD5
c2571c36c331f0d5bd8c67ff789a6100

SHA1
f879de1fdb675baf27bbbeba94114ca23be099da

SHA256
6650c64dab8bfba200daab73d82c0a8a3e5e7021b2e7a008a21489cfd65e7779

SHA512
2cce0c3a47335873c40ef9368da8767f85f0694eae19dd54df9143181c141e9587b85eeb75b4b1da5e355a02adda9614717dc96648ceac7efb6041fe45f8146b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6
MD5
96639b0993159716404025b20d6c423c

SHA1
aca02a9df58739ed9edfc2ea0683e7ddcd0af8f5

SHA256
5d89464c1999328df611451aadf26a5ae4dadd7cbac833ea0ff37efb7ccabda7

SHA512
9c2544923a4101ad7625fc133900116654468acedc09927daad438e98a1def91e14cb845ebccf23afe30e20fce68373a4c39916568dc4d2ff9cfa7d11106b5be

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6
MD5
9c94af75b533e39d02fcbf6de8e3cc6e

SHA1
cce6aa1a4b33cf153ce8170bbc297a1da1449ffc

SHA256
d882ba9acc386b5b45fc708ef4b1a79538520c3cb86e764bb4b931c0e76d323c

SHA512
b193e4c476251811bd724c77e3521709af65559150300d571146c1ee816f4c83ba0e525d3fae0d66ab76fcadab60f35ec6add1fbbc809ac15a1e83456c3a9f1b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\LogFiles\edb.log
MD5
398ac95d5e458b49657d2fd861428296

SHA1
4b3b0ce0e0ccfba99e74c3241140d340087d0bb2

SHA256
c0c998e8636f0192656f2b56434a18c8f30023989c8336d7f5f0fa4c0b088401

SHA512
18c8d66d221cf64944f1c4b7a9c12bdfeaec2595d2a036564d9a8658f3aa1b99965e56068497507ec7b540ab32e43d82abab58286f2a97c56ef49f602ba8b369

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\edb.chk
MD5
9dc192afaefdfe97cc8dd63b6e562b82

SHA1
39a4ef46d3307ba693d5c4cc7fd05ccfb86446b1

SHA256
de5cbfee70f54db3bb0deb1e54dd49262ae94514f134cbf59e99605d8bda8154

SHA512
20469544900e8ae1816a8d7978c86bd77661b161d8548a93d403c03af5ad741163192ed7855d540a9942e3542597dd18a97e0ea7e03599264548ae9b912ec458

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\spartan.edb
MD5
6dfdb8a73391ea049c11dcc6d28a8226

SHA1
5c6a026fc31be30b6f99ef134da6006b67e28c1f

SHA256
64c5016793e6d599602ae7f89e606ed9b182aa9ac0ea5900e4e7f66bb9e4b8d0

SHA512
e7051ef2a8842319ca62cb9e2c86336a0519bb9ddac18def05588236c6a7e5cf04ad2442141f61799b0051efd9b9ddb4ba338af63aa82e8de132e74d07eef99b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\spartan.jfm
MD5
048be47f924a7c2ff4664b270e3b4d7d

SHA1
dca21cf5049e910db96adb905dbe1e229adf4018

SHA256
8a1d066c7b19ea92e3856db7491812c52c400fa15df9e240ecfa9af00ad7b810

SHA512
cbd5ae2b18047a0fdf2d061c74eedc64f2222c670660f8cebf08413b3ea44206386f73d74e822d47171f3f22c9df1f2bc9eded63e9ed5d3332ec9977685e90d0

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\Recovery\Active\RecoveryStore.{441DEEA5-744C-4F86-BA40-8D2F73848B11}.dat
MD5
f810e3b003fc39d3d7c67a1427c60c7e

SHA1
bd6ae01c816d842e16d774413affbc1aca0b4a7d

SHA256
b96c292fb61f495ff4f1bcf062f9b01393ea590cc4a57986dffe9ed1a4a9c2f9

SHA512
2c060363a570606228181936794b4aa84f9dceaae0c21c66d615243c3169e8a6453bcf65ba251e584c11fbf63ac7396a13ad3f22cdaa899d1f39d9a77688d39b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\Recovery\Active\{E9EB081F-21D5-44FA-B61F-A7A8E98D7984}.dat
MD5
35a29b443ca645c06f1877bb0c72444e

SHA1
813c06f496389bed125d03f00a63e921a9b33aea

SHA256
40d060832d5ccd6267f753ad7a77ceb08c8b09229eb6dd22dd602e2af2a8743d

SHA512
a297ecdff59b2075c13edb2b56950e1b613299439527669416fe2ba81b341377d9def68d36713a53bcc594be0d00fe17592eb168f670febccc5a3d68f864bc6a

Download Submit
memory/424-2-0x0000000000000000-mapping.dmp

Download
memory/2344-5-0x0000000000000000-mapping.dmp

Download
memory/2344-4-0x00000000777D2000-0x00000000777D200C-memory.dmp

Filesize
12B

Download
memory/3212-3-0x0000000000000000-mapping.dmp

Download
memory/3912-6-0x00000000777D2000-0x00000000777D200C-memory.dmp

Filesize
12B

Download
memory/3912-7-0x0000000000000000-mapping.dmp

Download
memory/4060-13-0x0000000000000000-mapping.dmp

Download
memory/4060-12-0x00000000777D2000-0x00000000777D200C-memory.dmp

Filesize
12B

Download
memory/4240-17-0x00000000777D2000-0x00000000777D200C-memory.dmp

Filesize
12B

Download
memory/4240-18-0x0000000000000000-mapping.dmp

Download
memory/4420-21-0x0000000000000000-mapping.dmp

Download
memory/4420-20-0x00000000777D2000-0x00000000777D200C-memory.dmp

Filesize
12B

Download
memory/4636-26-0x0000000000000000-mapping.dmp

Download
memory/4936-23-0x00000000777D2000-0x00000000777D200C-memory.dmp

Filesize
12B

Download
memory/4936-24-0x0000000000000000-mapping.dmp

Download
memory/5220-46-0x0000000000000000-mapping.dmp

Download
memory/5380-42-0x0000000000000000-mapping.dmp

Download
memory/5584-43-0x0000000000000000-mapping.dmp

Download
memory/5692-44-0x0000000000000000-mapping.dmp

Download
memory/5876-45-0x0000000000000000-mapping.dmp

Download