eeaf27a2235d3814dd57e986c8955a8fda8278b6b8334e6512ce79b20147f021

Analysis

max time kernel
270s
max time network
246s
platform
windows10_x64
resource
win10-de-20211014
submitted
26-10-2021 18:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

zhqat.wqwumzbuze.vhog.lsbvy.pdjsjclqbh.cqtkrl.hcbecxiymo.hrpziom.lhceggrl.kwehit.njoosppe.qydq.aepfe.pdf
Size

211KB
MD5

6b6949be1ab1070de21f73254bdfd555
SHA1

309788fced3c5535991abb1296f9421db24cfc24
SHA256

eeaf27a2235d3814dd57e986c8955a8fda8278b6b8334e6512ce79b20147f021
SHA512

744e5482f6ec12e5a634daa89aadf6587c9354af69710cdffd5a8c94ed92bc74631b98dd2eafc0c6e4887f00eec5052db04ac705199fbbd1d4b68959a8cf1d10

Score

10^/10

persistence

Malware Config

Signatures

Registers COM server for autorun 1 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Drops file in Windows directory 7 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 5 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exeMicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exebrowser_broker.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdge.exeFileSyncConfig.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = b3c1e72753cad701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\DatastoreSchemaVersion = "8"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\CLSID = "{0E5AAE11-A475-4c5b-AB00-C66DE400274E}"	FileSyncConfig.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState\EdpState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus	MicrosoftEdgeCP.exe
Key deleted	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}	FileSyncConfig.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\LastClosedWidth = "1280"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = a8b2813053cad701	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 4612a33053cad701	MicrosoftEdge.exe
Key deleted	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_CLASSES\WOW6432NODE\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\INSTANCE\INITPROPERTYBAG	FileSyncConfig.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\ClearBrowsingHistoryOnStart = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 277a1f2753cad701	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	FileSyncConfig.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url4 = "https://login.live.com/"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdgeCP.exe
Key deleted	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_CLASSES\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\SHELLFOLDER	FileSyncConfig.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DontShowMeThisDialogAgain	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\InternetRegistry	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionI = "5"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Next Rating Prompt = e0508aaa2ef1d701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\System.IsPinnedToNameSpaceTree = "1"	FileSyncConfig.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\MigrationTime = 25b0743d06c1d701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows	MicrosoftEdge.exe
Key deleted	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_CLASSES\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\DEFAULTICON	FileSyncConfig.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\InProcServer32\ = "%systemroot%\\system32\\shell32.dll"	FileSyncConfig.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\OneTimeCleanup = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState\EdpCleanupState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\SmartScreenCompletedVersio = "1"	MicrosoftEdge.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

AcroRd32.exe

pid	process
4024	AcroRd32.exe
4024	AcroRd32.exe
4024	AcroRd32.exe
4024	AcroRd32.exe
4024	AcroRd32.exe
4024	AcroRd32.exe
4024	AcroRd32.exe
4024	AcroRd32.exe
4024	AcroRd32.exe
4024	AcroRd32.exe
4024	AcroRd32.exe
4024	AcroRd32.exe
4024	AcroRd32.exe
4024	AcroRd32.exe
4024	AcroRd32.exe
4024	AcroRd32.exe
4024	AcroRd32.exe
4024	AcroRd32.exe
4024	AcroRd32.exe
4024	AcroRd32.exe

Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

MicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

pid process

2140 MicrosoftEdgeCP.exe
2140 MicrosoftEdgeCP.exe
4180 MicrosoftEdgeCP.exe
4180 MicrosoftEdgeCP.exe
4180 MicrosoftEdgeCP.exe
4180 MicrosoftEdgeCP.exe

pid	process
2140	MicrosoftEdgeCP.exe
2140	MicrosoftEdgeCP.exe
4180	MicrosoftEdgeCP.exe
4180	MicrosoftEdgeCP.exe
4180	MicrosoftEdgeCP.exe
4180	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	pid	process
Token: SeDebugPrivilege	688	MicrosoftEdge.exe
Token: SeDebugPrivilege	688	MicrosoftEdge.exe
Token: SeDebugPrivilege	688	MicrosoftEdge.exe
Token: SeDebugPrivilege	688	MicrosoftEdge.exe
Token: SeDebugPrivilege	2108	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2108	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2108	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2108	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	688	MicrosoftEdge.exe
Token: SeDebugPrivilege	688	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	688	MicrosoftEdgeCP.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

4024 AcroRd32.exe

Suspicious use of SendNotifyMessage 9 IoCs

Processes:

AcroRd32.exe

pid	process
4024	AcroRd32.exe
4024	AcroRd32.exe
4024	AcroRd32.exe
4024	AcroRd32.exe
4024	AcroRd32.exe
4024	AcroRd32.exe
4024	AcroRd32.exe
4024	AcroRd32.exe
4024	AcroRd32.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

AcroRd32.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exe

pid	process
4024	AcroRd32.exe
4024	AcroRd32.exe
4024	AcroRd32.exe
4024	AcroRd32.exe
4024	AcroRd32.exe
4024	AcroRd32.exe
688	MicrosoftEdge.exe
2140	MicrosoftEdgeCP.exe
2140	MicrosoftEdgeCP.exe
5052	MicrosoftEdge.exe
4180	MicrosoftEdgeCP.exe
4180	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 4024 wrote to memory of 3784	4024	AcroRd32.exe	RdrCEF.exe
PID 4024 wrote to memory of 3784	4024	AcroRd32.exe	RdrCEF.exe
PID 4024 wrote to memory of 3784	4024	AcroRd32.exe	RdrCEF.exe
PID 4024 wrote to memory of 1924	4024	AcroRd32.exe	RdrCEF.exe
PID 4024 wrote to memory of 1924	4024	AcroRd32.exe	RdrCEF.exe
PID 4024 wrote to memory of 1924	4024	AcroRd32.exe	RdrCEF.exe
PID 3784 wrote to memory of 604	3784	RdrCEF.exe	RdrCEF.exe
PID 3784 wrote to memory of 604	3784	RdrCEF.exe	RdrCEF.exe
PID 3784 wrote to memory of 604	3784	RdrCEF.exe	RdrCEF.exe
PID 3784 wrote to memory of 604	3784	RdrCEF.exe	RdrCEF.exe
PID 3784 wrote to memory of 604	3784	RdrCEF.exe	RdrCEF.exe
PID 3784 wrote to memory of 604	3784	RdrCEF.exe	RdrCEF.exe
PID 3784 wrote to memory of 604	3784	RdrCEF.exe	RdrCEF.exe
PID 3784 wrote to memory of 604	3784	RdrCEF.exe	RdrCEF.exe
PID 3784 wrote to memory of 604	3784	RdrCEF.exe	RdrCEF.exe
PID 3784 wrote to memory of 604	3784	RdrCEF.exe	RdrCEF.exe
PID 3784 wrote to memory of 604	3784	RdrCEF.exe	RdrCEF.exe
PID 3784 wrote to memory of 604	3784	RdrCEF.exe	RdrCEF.exe
PID 3784 wrote to memory of 604	3784	RdrCEF.exe	RdrCEF.exe
PID 3784 wrote to memory of 604	3784	RdrCEF.exe	RdrCEF.exe
PID 3784 wrote to memory of 604	3784	RdrCEF.exe	RdrCEF.exe
PID 3784 wrote to memory of 604	3784	RdrCEF.exe	RdrCEF.exe
PID 3784 wrote to memory of 604	3784	RdrCEF.exe	RdrCEF.exe
PID 3784 wrote to memory of 604	3784	RdrCEF.exe	RdrCEF.exe
PID 3784 wrote to memory of 604	3784	RdrCEF.exe	RdrCEF.exe
PID 3784 wrote to memory of 604	3784	RdrCEF.exe	RdrCEF.exe
PID 3784 wrote to memory of 604	3784	RdrCEF.exe	RdrCEF.exe
PID 3784 wrote to memory of 604	3784	RdrCEF.exe	RdrCEF.exe
PID 3784 wrote to memory of 604	3784	RdrCEF.exe	RdrCEF.exe
PID 3784 wrote to memory of 604	3784	RdrCEF.exe	RdrCEF.exe
PID 3784 wrote to memory of 604	3784	RdrCEF.exe	RdrCEF.exe
PID 3784 wrote to memory of 604	3784	RdrCEF.exe	RdrCEF.exe
PID 3784 wrote to memory of 604	3784	RdrCEF.exe	RdrCEF.exe
PID 3784 wrote to memory of 604	3784	RdrCEF.exe	RdrCEF.exe
PID 3784 wrote to memory of 604	3784	RdrCEF.exe	RdrCEF.exe
PID 3784 wrote to memory of 604	3784	RdrCEF.exe	RdrCEF.exe
PID 3784 wrote to memory of 604	3784	RdrCEF.exe	RdrCEF.exe
PID 3784 wrote to memory of 604	3784	RdrCEF.exe	RdrCEF.exe
PID 3784 wrote to memory of 604	3784	RdrCEF.exe	RdrCEF.exe
PID 3784 wrote to memory of 604	3784	RdrCEF.exe	RdrCEF.exe
PID 3784 wrote to memory of 604	3784	RdrCEF.exe	RdrCEF.exe
PID 3784 wrote to memory of 604	3784	RdrCEF.exe	RdrCEF.exe
PID 3784 wrote to memory of 604	3784	RdrCEF.exe	RdrCEF.exe
PID 3784 wrote to memory of 604	3784	RdrCEF.exe	RdrCEF.exe
PID 3784 wrote to memory of 604	3784	RdrCEF.exe	RdrCEF.exe
PID 3784 wrote to memory of 604	3784	RdrCEF.exe	RdrCEF.exe
PID 3784 wrote to memory of 604	3784	RdrCEF.exe	RdrCEF.exe
PID 3784 wrote to memory of 884	3784	RdrCEF.exe	RdrCEF.exe
PID 3784 wrote to memory of 884	3784	RdrCEF.exe	RdrCEF.exe
PID 3784 wrote to memory of 884	3784	RdrCEF.exe	RdrCEF.exe
PID 3784 wrote to memory of 884	3784	RdrCEF.exe	RdrCEF.exe
PID 3784 wrote to memory of 884	3784	RdrCEF.exe	RdrCEF.exe
PID 3784 wrote to memory of 884	3784	RdrCEF.exe	RdrCEF.exe
PID 3784 wrote to memory of 884	3784	RdrCEF.exe	RdrCEF.exe
PID 3784 wrote to memory of 884	3784	RdrCEF.exe	RdrCEF.exe
PID 3784 wrote to memory of 884	3784	RdrCEF.exe	RdrCEF.exe
PID 3784 wrote to memory of 884	3784	RdrCEF.exe	RdrCEF.exe
PID 3784 wrote to memory of 884	3784	RdrCEF.exe	RdrCEF.exe
PID 3784 wrote to memory of 884	3784	RdrCEF.exe	RdrCEF.exe
PID 3784 wrote to memory of 884	3784	RdrCEF.exe	RdrCEF.exe
PID 3784 wrote to memory of 884	3784	RdrCEF.exe	RdrCEF.exe
PID 3784 wrote to memory of 884	3784	RdrCEF.exe	RdrCEF.exe
PID 3784 wrote to memory of 884	3784	RdrCEF.exe	RdrCEF.exe
PID 3784 wrote to memory of 884	3784	RdrCEF.exe	RdrCEF.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\zhqat.wqwumzbuze.vhog.lsbvy.pdjsjclqbh.cqtkrl.hcbecxiymo.hrpziom.lhceggrl.kwehit.njoosppe.qydq.aepfe.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4024

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
- Suspicious use of WriteProcessMemory
PID:3784

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=83E9B762A06AE3C6FC2ACEE6B5786933 --mojo-platform-channel-handle=1632 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:604

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=0EBBAE6560A789B527A25A4B4E9F4265 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=0EBBAE6560A789B527A25A4B4E9F4265 --renderer-client-id=2 --mojo-platform-channel-handle=1728 --allow-no-sandbox-job /prefetch:1
3⤵
PID:884

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=453260F9F55CA4737DC8EBB5BF15CBF5 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=453260F9F55CA4737DC8EBB5BF15CBF5 --renderer-client-id=4 --mojo-platform-channel-handle=2092 --allow-no-sandbox-job /prefetch:1
3⤵
PID:3052

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=26E830203A98C5307C3C896E4B361BA8 --mojo-platform-channel-handle=2456 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:2472

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=310DEB06DD582ADCD657B7522299FBB7 --mojo-platform-channel-handle=1624 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:1472

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A30B174E4EE98C77886303ECDAE2ED07 --mojo-platform-channel-handle=1716 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:1860

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
PID:1924

C:\Windows\SysWOW64\LaunchWinApp.exe
"C:\Windows\system32\LaunchWinApp.exe" "https://www.google.com/url?q=%68%74%74%70%73%3a%2f%2f%6d%65%65%74%64%72%65%61%6d%78%74%2e%63%6f%6d%2f%3f%75%74%6d%5f%73%6f%75%72%63%65%3d%41%50%73%38%71%56%68%30%32%35%54%38%26%75%74%6d%5f%63%61%6d%70%61%69%67%6e%3d%67%5f%6f%63%32%35%2e%31%26%61%78%72%3d%70%6f%39%30%6d%65&sa=D&sntz=1&usg=AFQjCNE894KO7qVUCZ8HbKFowuyOOqV2wQ"
2⤵
PID:64

C:\Windows\SysWOW64\LaunchWinApp.exe
"C:\Windows\system32\LaunchWinApp.exe" "https://www.google.com/url?q=%68%74%74%70%73%3a%2f%2f%6d%65%65%74%64%72%65%61%6d%78%74%2e%63%6f%6d%2f%3f%75%74%6d%5f%73%6f%75%72%63%65%3d%41%50%73%38%71%56%68%30%32%35%54%38%26%75%74%6d%5f%63%61%6d%70%61%69%67%6e%3d%67%5f%6f%63%32%35%2e%31%26%61%78%72%3d%70%6f%39%30%6d%65&sa=D&sntz=1&usg=AFQjCNE894KO7qVUCZ8HbKFowuyOOqV2wQ"
2⤵
PID:5000

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:688

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:1480

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:2140

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2108

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5052

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:5088

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:4180

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4396

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.196.0921.0007\FileSyncConfig.exe
"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.196.0921.0007\FileSyncConfig.exe"
1⤵
- Modifies registry class
PID:4308

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:688

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:856

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4780

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\F4ZP9QFC\90E6XT1M.htm
MD5
a2008248d71ab3d0dd85fb046092df52

SHA1
2bed7ca440abef683d9dcabaa48db58c10b06c4b

SHA256
3ae980fda39150f11b9df8160b3b7df0e932db6cd1dcba4090a8f683e89a00ab

SHA512
1651a289f72d5cd026ca50371b6f26b81314a7a828b98e9505183223f8e86d0c07f1257efc27978b38e6129f1138be056cade4df995c0fb8be142e2b2f03b311

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\K2A6W6TC\url[1].htm
MD5
15ae1f1453dab6c11bb3ebf5ae6cedd2

SHA1
9cee0b69db7fdba75bdd029937a2cc33e5ebe253

SHA256
ed8e93674c2ac79546504af419a24e3d750f56b0e0f27caaab258c8eaab1036e

SHA512
89e4fe7f2fe47a351087aa18c185c5f221fe2968f3ec55148cadf5828680d911505757cf5f142f15c10f5323f1d0c0d2b51d628dcdbfb27a4847d9118ebc4271

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\NETF06YB\f[1].js
MD5
958569a4ded23f07dea872676ef087ba

SHA1
e33c5f3a3885294e49a11654cbddc67704fb2ce1

SHA256
963a44fa6cbb7486c60762c3ee87598cebac50d93ffc8bcda9ac4b946637138b

SHA512
a6d2fcb608653eb1daa17ed194d3524716e09718dc65e372bc39bed847adfe17663ea4c16b8be2c7b356935bb50c7124e5c3a7ae1213cb2491ba19b1f0a94c02

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\I13TCDL6.cookie
MD5
4ecd1c245d129ab19e8bc7d07353eccd

SHA1
186d0e4031af4dc387bf5965195f35d49d4340d9

SHA256
aee59d76dfa2e8fc183d8b3041ff1c95de44404e1d09416be53f3cb978aa0eef

SHA512
4bba20d9f0e5d1856cabeafd732bb73a5f68d46f9a2f35f9ec37b8ea726a22377a973435b3a7db9a59fd5f174d055771cf4b0c9ac678e5e8ee34651e377ec36d

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\VV61KA8E.cookie
MD5
6506823ba3c39e1156a3ff74745e97e3

SHA1
07e3bf7520599e719aea5e16eecc33eb96ec2599

SHA256
f604a01915e0644a91a3bc05b6f52b905b818f2decdfb9f33d2c24ea4d22ac3c

SHA512
0ec4ca46b9aacc497de4c9bd86f7c0379815f3f06d84b70fd0ce5fdd0aea398a60c1a461fa5ab29f84b93fb3ea53a6221adaf36cc3bb2702ed2509dd34aefbfb

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
MD5
45ae4c94440b86d556d008976da3ba12

SHA1
59af8c430eb5348a74bc5369c875730ce1302512

SHA256
5adaf4262e492af02b2a24430e8ff49511be54bb7c67449449a7d00c2206c8bc

SHA512
2064cb934f4a451180d7060f46e8771116ba3829e774eec27b362933857f90c36ace51b86bd033ec53affcf76c4ca63e80ee5981c4c6f999a4377dd5153e6252

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
MD5
54e9306f95f32e50ccd58af19753d929

SHA1
eab9457321f34d4dcf7d4a0ac83edc9131bf7c57

SHA256
45f94dceb18a8f738a26da09ce4558995a4fe02b971882e8116fc9b59813bb72

SHA512
8711a4d866f21cdf4d4e6131ec4cfaf6821d0d22b90946be8b5a09ab868af0270a89bc326f03b858f0361a83c11a1531b894dfd1945e4812ba429a7558791f4f

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\1D738A6A7216EAD07EA5FAEDBBD737D0
MD5
8fa3346b50df79e30f3b1adfbd44cf3f

SHA1
e7ec65fe5ed96db238111e17da2dcb23612de9db

SHA256
62b3a476b813fd5eeed9f48c743ecc98baa3d21d776237fba5e966ffeb6be467

SHA512
db8b36feca90b2424ea932298d9ddeb017677af5ae1b160dbdb4a5d9024d69ac4dd0ffb7be42e2e53427edc07b6d8225ea19742888ea19b68931cc699d1ecc68

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
MD5
bb0a84196eb7e904ac8070999646d9be

SHA1
1aed013f00b67d6c76d8306b37f91e5a18f5a9b6

SHA256
8b137683290866ef05dd4879bc8090db3b3e05cd63e5f0c72cc0358dbc5984ab

SHA512
dd48f338ae8efb5ff3ee42ca5e4f23b99b203d71afd23a0a3353961e586a36ca253db8b3e098368077c82d27d427f6a94032e1d4b81262171379cefc769893ea

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_C6A93E474E7526CD4671916BE23315C9
MD5
0a76cb3e45d718d91c83daaa0f5d1346

SHA1
15003da7ed0d47c3941df77d10bcd948b0a55eb1

SHA256
2bb4221e9c56f06e734f6a9210602641e154fd0ffbff76709a36d8eea98aae58

SHA512
682a3ef4aa6afd705fd2b73af678df9929865d9785b43a92180aadc2d8ae732f128c93cdb40846e8e35b4bc978287cc725d351834b5c9c3eb6dec4b986cbe734

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
MD5
0bb9633d7cd76baa735473052f61aad0

SHA1
99fe3252b0d121c6eaf41471710401ef09d6222b

SHA256
565d5fa72ba1dce92a850a73d0e85d05c90542e4e58e897c1ff1245e427641db

SHA512
9e5df54ed0e4e27f68b3b74d467946c8fbaf020e97d3b0ed65f5f37d768af26cef7e6f633bed045fe9d6284eb4f09e7b2656e0805ba83c356eabfc0fd726a341

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_86D88E3420C534FCF630732C19940281
MD5
9236f1c50bee292d0ab38111bd7be75f

SHA1
9138cfa16d483546ddeaf83cf8a0dbe760260f00

SHA256
53c1fe87c2edc544328e02af473f1488614b036d61a8d86366ae82d4b1a45341

SHA512
de6e5b787bb947fc7bb4f633a996a00f5e54927338b7573af3d16093bc4af9187e8abed493b997121f577cc786c9a16205237b281a81619223cfcf3413b382de

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
MD5
bdf3dbb928c6755deb36ea5c31d42df0

SHA1
dfa16bffd25cefe1cf48d323649b2d3b7e81f056

SHA256
e92857babb45ecfe5c5a1f2161f98236a1a1e218dec93cd609f691014398b95f

SHA512
60ef0ee4d86494a360f2611830173e070cc407233739ce5da6ba7bdf204c95659085e5ea56afba82df3de7172c9f41c87f240ea0f946378cd4d5de3f34ef61c9

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
MD5
64e9b8bb98e2303717538ce259bec57d

SHA1
2b07bf8e0d831da42760c54feff484635009c172

SHA256
76bd459ec8e467efc3e3fb94cb21b9c77a2aa73c9d4c0f3faf823677be756331

SHA512
8980af4a87a009f1ae165182d1edd4ccbd12b40a5890de5dbaea4dbf3aeb86edffd58b088b1e35e12d6b1197cc0db658a9392283583b3cb24a516ebc1f736c56

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_F7D7B42EA8B66002A0036EC71B564814
MD5
0e499ded72f6994a45a1a5a45f1dfd5b

SHA1
857961b648ff57cafdc298ad9df11fefd337d868

SHA256
dd37739bc9ee78e37075ed45d611e5f4322db4ecb14b63c54f800264e01d3ae1

SHA512
ec69fb0ea09da4496c93187ad28fbe7308575c6919616426cff82caf2fdef90fc1705f548bec70a0aafcfd95f68651644db5460b79d1cfdcb3425a8b5aea4b71

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
MD5
a644a4b03b4096a78f4bb6beedf5fcb7

SHA1
7ecde39a016174c6986fcaf4e626d8fb6b6cbccc

SHA256
598c080ad65ffaafcc05a482bbe87141a4aa7334b874b98db2cf773d28ade95c

SHA512
63edbf0ed763a9901ffc40b5892f817bd7a8270efab4680cda1e35ba281373931018b047db831b766acf7f7a5d4ae7a017d690a7abf1d8d16215bd8b866b63d6

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
MD5
64140b3f2a06faf44007d825e16568cd

SHA1
9ad545bb1606b1a005d7bb64bdef6146b1386d1c

SHA256
ca3509e15f3013a054eefd11345f4e81d75cb3832299d7a974cbb2ff2e075441

SHA512
eb9dcb429b6250850ca852504b2977e514422d9617023df023ff9bebc5f47b30201732a56bfaa0e53bb225d850b791a1f2262dae26edc455a78f50764cb19dab

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\1D738A6A7216EAD07EA5FAEDBBD737D0
MD5
a612ad30efd60a4cc6b495432ddce6fa

SHA1
2262d3f59c7cbd043f69ce9cf56fe6d0f5f4c59c

SHA256
05419dd62bdabb92900d44e0632c3980065f0576dda63c40455bfe620e10179d

SHA512
f79f4e5cdb80560a2623cf836bfe31ca185cd419346aed5695bee83ed1b4cb1071e266b240ee3a60641ba7c050bdff4c48afe6b3ea5f1402e011d735e4a6d33d

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
MD5
a50812eea59048b5df1441aabe1cde09

SHA1
235e6633f233b267f8a4eadf29b23af36558694f

SHA256
dc2113cc4b021b2daaf671705183d2598ebc142865266be8fc376ef1e56215c2

SHA512
a394a712d44eb1899628f736d9ad7a839060084204e1a38d76d133ba737b616b867435d491e6f229b78324abcbded455d87cc4e15b8373901227afa875e713b9

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_C6A93E474E7526CD4671916BE23315C9
MD5
f274cc09906b8aefd1f214abcc2fe610

SHA1
695b882e47c911ed99941316b46bbff31d52f703

SHA256
7959edf7c6518a2394bedc8c63d3e88045e215620b41f50c6a43be6df3a9eeee

SHA512
ab2c959b9b43ae8324a7e803a09c53c6bc5b7eff7e6d4511c93677d44ab3ae204217c7f15982c97117f10eb113ed86b705266accd32127b006c8f53d9dcd1bda

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
MD5
7a0c6a3dc76b2f6b0d222e0f269b555b

SHA1
b12d9d577fcedb7f886ef31a09e6b88079a81f78

SHA256
68a88ce554b48e4d639359567bef58a46f80f08ab5771b6587eefe6496856aa5

SHA512
5693f2260f35b3c4159f28f426101c005e2826f02b9e07992a9bd67985863b03b180d149de623da14103ffd098022baaa5c3151ae6b7e3fd919bbef57f9fc3db

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_86D88E3420C534FCF630732C19940281
MD5
9e648bfd1b9185e979b2a27a8a8c5074

SHA1
78a8b22a74b08af47e405727cd3e67a291b752b0

SHA256
3decc53f63431b2e843cc8bab0c163dea1006a72c280df9d4f18d33e580c9c1f

SHA512
02d6a83440f86db7506ca519b6f7d89b434d7f46d9beb45b97af25280b43740187b2989867b9b679978fb70eb0d8e6694e7b2113cd5ef225eed226b52a336711

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
MD5
7352e63d68e2ba983f4d9fc343125f9a

SHA1
e927f7822bf11a80b670e7989c169afedbb85831

SHA256
8fed2249148b8cf49656d1406507dd4b67a841f856e6a372e4000af3cbf9df4c

SHA512
2e3c1b99bd6fb806ceac543ed3783d327394a5279c6e5c2b6f01dd630a5b6ec277adf6a87d31727bc440c3d5b505c6f360dfde15850f11c537e061faf38e9ea3

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
MD5
9720a97af6d36d32b1f216edf50e9b86

SHA1
0ee63fc871e8910ee80b850181d0b5f0c26680fa

SHA256
d23076307d6d47f718f64b89c2858bf02d8e365eb3e2fff85f7c61fbee0d7cbe

SHA512
e58458bdc9053e9df988e387580e147c736b82caaa8d070603a0395bb3fbe747240218f7dd664e9a626158309d9687ff948fcb9befb6b6192a44107d0b6e86d1

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_F7D7B42EA8B66002A0036EC71B564814
MD5
eeb99c930294d3ee9fa2c6fb4e283a89

SHA1
e79e7b1661ca2d155aa485bbceb6ba9a49073554

SHA256
152356fafcc9b6570c5ce20b4963517be38cbcd6a96f0f852be947e4051c3d2d

SHA512
8fb1082373e23e2e513fdcba8ea85f54e548914b3479819b9717bb0f7c1b17aab05e592e7d68b5bbb4ba57d7ee4f6ab0d978f610d028c130405db9870c323be9

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\Windows\3720402701\2274612954.pri
MD5
0db264b38ac3c5f6c140ba120a7fe72f

SHA1
51aa2330c597e84ed3b0d64bf6b73bf6b15f9d74

SHA256
2f6955b0f5277a7904c59e461bfa6b06c54fece0d7c11f27408fa7a281a4556d

SHA512
3534c243516cef5cee0540d5efd5cde1f378e127e6013b5e309a2e0be8393417bfe458706564b4b955f92132a51e2772c67f9fd90441476cc3512a5d9f910d84

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\A8820W4P\favicon[1].ico
MD5
f3418a443e7d841097c714d69ec4bcb8

SHA1
49263695f6b0cdd72f45cf1b775e660fdc36c606

SHA256
6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770

SHA512
82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\C0HPARIK\favicon[1].ico
MD5
0ad13bc614e5712ee6f44e02b06317d4

SHA1
204983e44abb8473c3682746f0b9bd197d271ae0

SHA256
aaa214bbf5bbd91912a00ed5700862aab7dd04aef9d43b3b77c68087daeb7011

SHA512
b3af4e36fde218bbf844c6bd5df6af4ddb5c08708aefce2274a8d96026dae06e5c7aff265a04696b2f86c1e191419553575a711771e7d2f1be01f8ee8f6aa1d1

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\LogFiles\edb.log
MD5
ab397b085dd2dcb01f864373770c2989

SHA1
cf9988b700e82a50576e37342f9e6c9624f712bb

SHA256
a9fd0cbfb1f0ed1c03964e27e6eafc9ad197dcbc31711b029b931632e99d1769

SHA512
fe1efeca103e1787e13abcd26faf18a6316305f4541f7f733d89aad8ae062706dd7ac98b05bb557fc3843b7080cfce60d3bf92f9048dc4686028361cb1fa6bd6

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\edb.chk
MD5
67e6b06c45d776ce531bfc867ee5d1c5

SHA1
d672980eb4136130d24830d75aa8bfb11b850518

SHA256
1259c16b40a32499efa04ee4281b871186705effa3c282d2ce678f2b7c06f57b

SHA512
8fef2fabee00ef7c6159ffc6ca06f4c6e6f8a132aad003893b86ffe43cf2deab05be579656f37453734ae93ca45187806562ee0d343fd107dbd703cdb45c0271

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\spartan.edb
MD5
1270a1d50c30f4b9cb8cd76b00f41e2e

SHA1
c7efa69e466c05b686d81750b04f25946759b7df

SHA256
6d730ab4594aa6d1ee473edcabd21a9b279e2fe06e7adf6c2b909768fdbb8d61

SHA512
826a6395dff664d9e3632999ef3ba2ce8bbeef83583fed8028aa2703fd5d1422f4cdd2f8553abe8c76523fd4542faae747e88c04f2fbf3b0ffd019e5170e4af8

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\spartan.jfm
MD5
ae4752f38671706fa51f992f03706d42

SHA1
739027db964fa99041d1b92677e5b3109e9cf1ba

SHA256
8d6b8d6143755e7df350ef32ea4eec1722448281c517a6ff7f4dfcfbc237a72b

SHA512
927a2d5cf15d37fb0529f948997c48d1bcf8601f2e01dcd3576a1cafa69fdd21171bca15ba28e67e31c2a359b22f21dd1f112f39bbc79ecd8e3fd87b899cca24

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\ImageStore\jp2izr3\imagestore.dat
MD5
432e076abdfb3862189457b11ecda956

SHA1
f84f42314d777a67d9a9e866227badd1143e51fa

SHA256
d6702b20e7e3b6826acb97a80f49c29ee636ccbdb5ceb1c3401114b574c6faa8

SHA512
5be5a528365c18278c4fe731db77e6e6197d03493090d8cb7f23f0c0bca28ea4f143fa6f7cc2145a979b8f536d238ac4e31b4d566e886173c4515f95b857b123

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\Recovery\Active\RecoveryStore.{32D9A5CD-6E61-4275-B9AB-050BD51F0532}.dat
MD5
239a67d6ea1c9dc9ce175c5e7eddd154

SHA1
df3cf0fe1b516387bd567b280712eca1ca7fde82

SHA256
9c2f438072f8418318b4e5e38dd2790ba372dfe1b22cc2789b6d16fc3db8b317

SHA512
f78e66fcd575c1c789205480b426d3174b06810d076f71e3150778b9f97b365e8692535599954ce211673954f3282fb38b29b453a7c42075cbd57e88c81117c0

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\Recovery\Active\{441420BF-33E7-49D3-80B7-031A7222DA16}.dat
MD5
efa3404de1b44d0a40612b136c924837

SHA1
e1f682b88b5bf20ee1f4e5e8dfdb421b3f6e2fda

SHA256
222617a75ec7cd5c109c5e4750a05c465c4387d6d98c612a77388086a9b33374

SHA512
210ef7c2c48a9ebf248e945148afa76bef59511e31556c04266a10bf633625389209ff8343d4963a599ec644140d81b2ce8863bb7a37c6c004dbc52c494a86db

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\Microsoft\Windows\3720402701\2274612954.pri
MD5
0db264b38ac3c5f6c140ba120a7fe72f

SHA1
51aa2330c597e84ed3b0d64bf6b73bf6b15f9d74

SHA256
2f6955b0f5277a7904c59e461bfa6b06c54fece0d7c11f27408fa7a281a4556d

SHA512
3534c243516cef5cee0540d5efd5cde1f378e127e6013b5e309a2e0be8393417bfe458706564b4b955f92132a51e2772c67f9fd90441476cc3512a5d9f910d84

Download Submit
memory/64-145-0x0000000000000000-mapping.dmp

Download
memory/604-119-0x0000000000000000-mapping.dmp

Download
memory/604-120-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/604-117-0x0000000077B82000-0x0000000077B83000-memory.dmp

Filesize
4KB

Download
memory/604-118-0x0000000000F0C000-0x0000000000F0D000-memory.dmp

Filesize
4KB

Download
memory/884-122-0x0000000000BE6000-0x0000000000BE7000-memory.dmp

Filesize
4KB

Download
memory/884-121-0x0000000077B82000-0x0000000077B83000-memory.dmp

Filesize
4KB

Download
memory/884-126-0x0000000000C00000-0x0000000000C01000-memory.dmp

Filesize
4KB

Download
memory/884-123-0x0000000000000000-mapping.dmp

Download
memory/884-125-0x0000000000510000-0x0000000000511000-memory.dmp

Filesize
4KB

Download
memory/1472-139-0x0000000000000000-mapping.dmp

Download
memory/1472-138-0x00000000012A7000-0x00000000012A8000-memory.dmp

Filesize
4KB

Download
memory/1472-137-0x0000000077B82000-0x0000000077B83000-memory.dmp

Filesize
4KB

Download
memory/1860-142-0x00000000007E5000-0x00000000007E6000-memory.dmp

Filesize
4KB

Download
memory/1860-141-0x0000000077B82000-0x0000000077B83000-memory.dmp

Filesize
4KB

Download
memory/1860-143-0x0000000000000000-mapping.dmp

Download
memory/1924-116-0x0000000000000000-mapping.dmp

Download
memory/2472-133-0x0000000077B82000-0x0000000077B83000-memory.dmp

Filesize
4KB

Download
memory/2472-134-0x0000000000916000-0x0000000000917000-memory.dmp

Filesize
4KB

Download
memory/2472-135-0x0000000000000000-mapping.dmp

Download
memory/3052-127-0x0000000077B82000-0x0000000077B83000-memory.dmp

Filesize
4KB

Download
memory/3052-128-0x00000000009A0000-0x00000000009A1000-memory.dmp

Filesize
4KB

Download
memory/3052-129-0x0000000000000000-mapping.dmp

Download
memory/3784-115-0x0000000000000000-mapping.dmp

Download
memory/5000-146-0x0000000000000000-mapping.dmp

Download
memory/5052-147-0x000001E89E220000-0x000001E89E230000-memory.dmp

Filesize
64KB

Download