ModuloConfermaIndirizzo_2016_56.zip
ModuloConfermaIndirizzo_2016_56.pdf
89KB
16-11-2021 11:58
3e4e9232f4a973055eef13a2692ffc54
94cc703064b56a0416d884be1bf6a2edb66521c1
445f1576ff067209bd366064032e5826ef4b3b0e6b299184443053be75e49289
Filter: none
-
Drops file in Windows directoryMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exe
Reported IOCs
description ioc process File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdgeCP.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdge.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdge.exe -
Checks processor information in registryAcroRd32.exe
Description
Processor information is often read in order to detect sandboxing environments.
TTPs
Reported IOCs
description ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
Modifies Internet Explorer settingsbrowser_broker.exeMicrosoftEdgeCP.exebrowser_broker.exeAcroRd32.exeMicrosoftEdge.exe
Tags
TTPs
Reported IOCs
description ioc process Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe -
Modifies registry classMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe
Reported IOCs
description ioc process Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B72164 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\MigrationTime = 25b0743d06c1d701 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 1f12d2f044ddd701 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{C129529C-A171-4EC8-A61B-8E889B3A7CD5} = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\DisallowDefaultBrowserPrompt = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DOMStorage MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CacheLimit = "1" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\ClearBrowsingHistoryOnStart = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = 010000000b66ad45a3585a70599d88b82c7ccef63bda3a6904cc2bf5b0d2e626fe2a7c53c8de28819c8e2fb4f61af12531a24cb654876503ca644ed02e292cfb55c7397d6c285388d451e1aeecf1ba2efabdf831a255c14e279a343cb0a8624302e955ac41e3a3e8ffc1f5afd4c1080104eeed87b7e49fed9e8c394ee9f0b3c008b0c291abae9abcc2feb8ec7d2a08944c534111dfd46aa8265c6e3e38a2e322b73b8e1e522bcf1f8428342a1ecc8dd6a20d544b34c60da6eb28c2b38a5c2015dcacfd63ccf850b0ff5f31347a4732f1ba3cd0156e58ddb870121ee90cc0d3df5122faac92b7cb2198c3e525773b13c261012f3f162bf1b6be380e9a896c509328bd99f84b0710e0e27438831d48f56a187ab95f0fdff5e47cbc43c4de01c2c9879c29bddd87e8c083921222620e5b68d7c8e008ca14cc71bdbc8b39382099f2dbe16ffda4d95ac6cf3d3ae09e2cc86d9d0ba73dac6aa201025af6ffb3670034f3abcda9659c64f3b5955b2d9844f3c63f64f14492816c46bbb4037e5b7813d73a1a135a986f112b77bb5463def50151f1f174be1dfa94a968ec3484c2b3cf21753c1734f7938a0239a9 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\InProgressFlags = "0" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url4 = "https://login.live.com/" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = 0100000073876f276b942bc09d094e1034d652a623ecaf904f3646cdd8b3aae13c2777ce1b09d4b070af665b63d8e242396f1231010761c5860e351d72cf MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\ClearBrowsingHistoryOnStart = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites\Order = 0c0000000a000000000000000c0000000100000000000000 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe -
Suspicious behavior: EnumeratesProcessesAcroRd32.exe
Reported IOCs
pid process 4176 AcroRd32.exe 4176 AcroRd32.exe 4176 AcroRd32.exe 4176 AcroRd32.exe 4176 AcroRd32.exe 4176 AcroRd32.exe 4176 AcroRd32.exe 4176 AcroRd32.exe 4176 AcroRd32.exe 4176 AcroRd32.exe 4176 AcroRd32.exe 4176 AcroRd32.exe 4176 AcroRd32.exe 4176 AcroRd32.exe 4176 AcroRd32.exe 4176 AcroRd32.exe 4176 AcroRd32.exe 4176 AcroRd32.exe 4176 AcroRd32.exe 4176 AcroRd32.exe -
Suspicious behavior: MapViewOfSectionMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe
Reported IOCs
pid process 4488 MicrosoftEdgeCP.exe 2164 MicrosoftEdgeCP.exe -
Suspicious use of AdjustPrivilegeTokenMicrosoftEdge.exeMicrosoftEdgeCP.exe
Reported IOCs
description pid process Token: SeDebugPrivilege 3756 MicrosoftEdge.exe Token: SeDebugPrivilege 3756 MicrosoftEdge.exe Token: SeDebugPrivilege 3756 MicrosoftEdge.exe Token: SeDebugPrivilege 3756 MicrosoftEdge.exe Token: SeDebugPrivilege 1704 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 1704 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 1704 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 1704 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 3756 MicrosoftEdge.exe -
Suspicious use of FindShellTrayWindowAcroRd32.exe
Reported IOCs
pid process 4176 AcroRd32.exe -
Suspicious use of SendNotifyMessageAcroRd32.exe
Reported IOCs
pid process 4176 AcroRd32.exe 4176 AcroRd32.exe 4176 AcroRd32.exe 4176 AcroRd32.exe 4176 AcroRd32.exe 4176 AcroRd32.exe 4176 AcroRd32.exe 4176 AcroRd32.exe 4176 AcroRd32.exe 4176 AcroRd32.exe 4176 AcroRd32.exe 4176 AcroRd32.exe 4176 AcroRd32.exe 4176 AcroRd32.exe -
Suspicious use of SetWindowsHookExAcroRd32.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exe
Reported IOCs
pid process 4176 AcroRd32.exe 4176 AcroRd32.exe 4176 AcroRd32.exe 4176 AcroRd32.exe 4176 AcroRd32.exe 4176 AcroRd32.exe 3756 MicrosoftEdge.exe 4488 MicrosoftEdgeCP.exe 4488 MicrosoftEdgeCP.exe 4664 MicrosoftEdge.exe 2164 MicrosoftEdgeCP.exe 2164 MicrosoftEdgeCP.exe -
Suspicious use of WriteProcessMemoryAcroRd32.exeRdrCEF.exe
Reported IOCs
description pid process target process PID 4176 wrote to memory of 1968 4176 AcroRd32.exe RdrCEF.exe PID 4176 wrote to memory of 1968 4176 AcroRd32.exe RdrCEF.exe PID 4176 wrote to memory of 1968 4176 AcroRd32.exe RdrCEF.exe PID 1968 wrote to memory of 640 1968 RdrCEF.exe RdrCEF.exe PID 1968 wrote to memory of 640 1968 RdrCEF.exe RdrCEF.exe PID 1968 wrote to memory of 640 1968 RdrCEF.exe RdrCEF.exe PID 1968 wrote to memory of 640 1968 RdrCEF.exe RdrCEF.exe PID 1968 wrote to memory of 640 1968 RdrCEF.exe RdrCEF.exe PID 1968 wrote to memory of 640 1968 RdrCEF.exe RdrCEF.exe PID 1968 wrote to memory of 640 1968 RdrCEF.exe RdrCEF.exe PID 1968 wrote to memory of 640 1968 RdrCEF.exe RdrCEF.exe PID 1968 wrote to memory of 640 1968 RdrCEF.exe RdrCEF.exe PID 1968 wrote to memory of 640 1968 RdrCEF.exe RdrCEF.exe PID 1968 wrote to memory of 640 1968 RdrCEF.exe RdrCEF.exe PID 1968 wrote to memory of 640 1968 RdrCEF.exe RdrCEF.exe PID 1968 wrote to memory of 640 1968 RdrCEF.exe RdrCEF.exe PID 1968 wrote to memory of 640 1968 RdrCEF.exe RdrCEF.exe PID 1968 wrote to memory of 640 1968 RdrCEF.exe RdrCEF.exe PID 1968 wrote to memory of 640 1968 RdrCEF.exe RdrCEF.exe PID 1968 wrote to memory of 640 1968 RdrCEF.exe RdrCEF.exe PID 1968 wrote to memory of 640 1968 RdrCEF.exe RdrCEF.exe PID 1968 wrote to memory of 640 1968 RdrCEF.exe RdrCEF.exe PID 1968 wrote to memory of 640 1968 RdrCEF.exe RdrCEF.exe PID 1968 wrote to memory of 640 1968 RdrCEF.exe RdrCEF.exe PID 1968 wrote to memory of 640 1968 RdrCEF.exe RdrCEF.exe PID 1968 wrote to memory of 640 1968 RdrCEF.exe RdrCEF.exe PID 1968 wrote to memory of 640 1968 RdrCEF.exe RdrCEF.exe PID 1968 wrote to memory of 640 1968 RdrCEF.exe RdrCEF.exe PID 1968 wrote to memory of 640 1968 RdrCEF.exe RdrCEF.exe PID 1968 wrote to memory of 640 1968 RdrCEF.exe RdrCEF.exe PID 1968 wrote to memory of 640 1968 RdrCEF.exe RdrCEF.exe PID 1968 wrote to memory of 640 1968 RdrCEF.exe RdrCEF.exe PID 1968 wrote to memory of 640 1968 RdrCEF.exe RdrCEF.exe PID 1968 wrote to memory of 640 1968 RdrCEF.exe RdrCEF.exe PID 1968 wrote to memory of 640 1968 RdrCEF.exe RdrCEF.exe PID 1968 wrote to memory of 640 1968 RdrCEF.exe RdrCEF.exe PID 1968 wrote to memory of 640 1968 RdrCEF.exe RdrCEF.exe PID 1968 wrote to memory of 640 1968 RdrCEF.exe RdrCEF.exe PID 1968 wrote to memory of 640 1968 RdrCEF.exe RdrCEF.exe PID 1968 wrote to memory of 640 1968 RdrCEF.exe RdrCEF.exe PID 1968 wrote to memory of 640 1968 RdrCEF.exe RdrCEF.exe PID 1968 wrote to memory of 640 1968 RdrCEF.exe RdrCEF.exe PID 1968 wrote to memory of 640 1968 RdrCEF.exe RdrCEF.exe PID 1968 wrote to memory of 640 1968 RdrCEF.exe RdrCEF.exe PID 1968 wrote to memory of 816 1968 RdrCEF.exe RdrCEF.exe PID 1968 wrote to memory of 816 1968 RdrCEF.exe RdrCEF.exe PID 1968 wrote to memory of 816 1968 RdrCEF.exe RdrCEF.exe PID 1968 wrote to memory of 816 1968 RdrCEF.exe RdrCEF.exe PID 1968 wrote to memory of 816 1968 RdrCEF.exe RdrCEF.exe PID 1968 wrote to memory of 816 1968 RdrCEF.exe RdrCEF.exe PID 1968 wrote to memory of 816 1968 RdrCEF.exe RdrCEF.exe PID 1968 wrote to memory of 816 1968 RdrCEF.exe RdrCEF.exe PID 1968 wrote to memory of 816 1968 RdrCEF.exe RdrCEF.exe PID 1968 wrote to memory of 816 1968 RdrCEF.exe RdrCEF.exe PID 1968 wrote to memory of 816 1968 RdrCEF.exe RdrCEF.exe PID 1968 wrote to memory of 816 1968 RdrCEF.exe RdrCEF.exe PID 1968 wrote to memory of 816 1968 RdrCEF.exe RdrCEF.exe PID 1968 wrote to memory of 816 1968 RdrCEF.exe RdrCEF.exe PID 1968 wrote to memory of 816 1968 RdrCEF.exe RdrCEF.exe PID 1968 wrote to memory of 816 1968 RdrCEF.exe RdrCEF.exe PID 1968 wrote to memory of 816 1968 RdrCEF.exe RdrCEF.exe PID 1968 wrote to memory of 816 1968 RdrCEF.exe RdrCEF.exe PID 1968 wrote to memory of 816 1968 RdrCEF.exe RdrCEF.exe PID 1968 wrote to memory of 816 1968 RdrCEF.exe RdrCEF.exe
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ModuloConfermaIndirizzo_2016_56.pdf"Checks processor information in registryModifies Internet Explorer settingsSuspicious behavior: EnumeratesProcessesSuspicious use of FindShellTrayWindowSuspicious use of SendNotifyMessageSuspicious use of SetWindowsHookExSuspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=96349C434B80AFD92B7739CC90A49768 --mojo-platform-channel-handle=1636 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=7C9833741E8062C1133AE21132438FC3 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=7C9833741E8062C1133AE21132438FC3 --renderer-client-id=2 --mojo-platform-channel-handle=1652 --allow-no-sandbox-job /prefetch:1
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=AC854DFB4D9047923B905391A50F174B --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=AC854DFB4D9047923B905391A50F174B --renderer-client-id=4 --mojo-platform-channel-handle=2072 --allow-no-sandbox-job /prefetch:1
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=91147B65E5623BA5E4D91749AA82D248 --mojo-platform-channel-handle=2480 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C24399BEF6E9B4D35B86A670290F26D4 --mojo-platform-channel-handle=1780 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=FF4DFFF12824994F964FC8F230D8FA9C --mojo-platform-channel-handle=2508 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
-
C:\Windows\SysWOW64\LaunchWinApp.exe"C:\Windows\system32\LaunchWinApp.exe" "http://www.b-soft.it/FOTO/DHL/ModuloConfermaIndirizzo_2016.exe"
-
C:\Windows\SysWOW64\LaunchWinApp.exe"C:\Windows\system32\LaunchWinApp.exe" "http://www.b-soft.it/FOTO/DHL/ModuloConfermaIndirizzo_2016.exe"
-
C:\Windows\SysWOW64\LaunchWinApp.exe"C:\Windows\system32\LaunchWinApp.exe" "http://www.b-soft.it/FOTO/DHL/ModuloConfermaIndirizzo_2016.exe"
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mcaDrops file in Windows directoryModifies Internet Explorer settingsModifies registry classSuspicious use of AdjustPrivilegeTokenSuspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -EmbeddingModifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mcaModifies registry classSuspicious behavior: MapViewOfSectionSuspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mcaDrops file in Windows directoryModifies Internet Explorer settingsModifies registry classSuspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mcaDrops file in Windows directoryModifies registry classSuspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -EmbeddingModifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mcaSuspicious behavior: MapViewOfSectionSuspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mcaDrops file in Windows directoryModifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mcaModifies registry class
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\Windows\3720402701\2274612954.pri
MD50db264b38ac3c5f6c140ba120a7fe72f
SHA151aa2330c597e84ed3b0d64bf6b73bf6b15f9d74
SHA2562f6955b0f5277a7904c59e461bfa6b06c54fece0d7c11f27408fa7a281a4556d
SHA5123534c243516cef5cee0540d5efd5cde1f378e127e6013b5e309a2e0be8393417bfe458706564b4b955f92132a51e2772c67f9fd90441476cc3512a5d9f910d84
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\LogFiles\edb.log
MD54cfed7683bbe8134400d855ef6c5092f
SHA1cf1fe7732989a671da1c11e0386cdfeb097cfb2a
SHA2566528ee08a4c05b89cb8c2ccb344c7306d5d44c4467c5e4104eede127d0c1243a
SHA51294bf36f3f02267f80d8fea6cbf67b1d5368ce3d2a43552ed234a6b3f840a183f01a2ff079bb6a5728b1a6569226b58bb18bcd318b3bd6ddc401e8ceaec4325fa
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\edb.chk
MD599fac9448f8a161abbd89f141699a773
SHA149546849287236d12541d249af40367c62e1657b
SHA256397fc3b4ca56b039fdfc4c7b72e2a872fcbabad9d4221bb3fdfc8e0db7192fb0
SHA512e70340f865abe0160879bc8a3035bb62b571952f73b353b4d6631b6d2a0f74c8a4cc6aebc8406fa3712d30e943be63e63c7c40d4754a3069389ac742dd2d88bd
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\spartan.edb
MD5d96e7f9a6f64c41d30f7f74d0a7d05bc
SHA1d268c38769f9a4e4919c2979e572d5ed6b6f82ae
SHA256a55ad29731d26c2f31cfe9e127f80e02d4f7305817edbd48ebbd49bc99741b8c
SHA512de5713ad196cfad626bf1e79bb36891b764085e1fe2fe02e3a0ceb9e16c2a9d449d68ba2788933019bb402ad3fc6a2c9978438c6772bfca9fe53d07c4d94e4a8
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\spartan.jfm
MD56c98fc3297d33b9f32d56c8e96bb25cb
SHA12de589163a84f91f3083a55ab53d31b5e9625757
SHA256a571912432b53a3b63e7cc0241daded9a4fc75860092efd4454e510174360bc7
SHA512f2d50befc88ccd099f47e773e59f1bdc4d5efa5d8e158cdbd607cac90f1528e860400fb40fa8b305a837d3153ddb6d277c4b99ef40e48250d9ea3f41d7fec5b4
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\Recovery\Active\RecoveryStore.{454D8153-045E-487A-9208-A62DBEDF8773}.dat
MD5422f4f392508aec167107f542420a261
SHA1256bfa3bd4a888642fe24f46189448c20af9084a
SHA2562d5f3514f6a7d278e736f525f4b20ba724e08e3f62741eff704c85625fd18afa
SHA51256072315e579ab6eb792f85e3e14a8cebc37afd69587c2e5e9526314a01e02cd8b39cc6a874b7911c1d60d931b9652235e00733a5cbef3e2a819bb76fe83e8f7
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\Recovery\Active\{1948F61B-49EC-4012-A5D7-C8266334BD52}.dat
MD5444bd73a20db7b66cecea28ad3667c8c
SHA155cfef668e1b857a14ba5f344fe3d64ca99ab3f2
SHA256c46fe51da0eb80a01792b1bcabc0025a80b2de3a13ec28f072c2568ecdf0e41a
SHA51228362af2c159be18c710882cc46466ece96ca0fbe1e05b5f218084c0b2167543207a9d84b636b954c5bc53a7557e04f524c2f687893e6dfa81b9bf50fb95303c
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\Microsoft\Windows\3720402701\2274612954.pri
MD50db264b38ac3c5f6c140ba120a7fe72f
SHA151aa2330c597e84ed3b0d64bf6b73bf6b15f9d74
SHA2562f6955b0f5277a7904c59e461bfa6b06c54fece0d7c11f27408fa7a281a4556d
SHA5123534c243516cef5cee0540d5efd5cde1f378e127e6013b5e309a2e0be8393417bfe458706564b4b955f92132a51e2772c67f9fd90441476cc3512a5d9f910d84
-
memory/640-116-0x0000000077AC2000-0x0000000077AC3000-memory.dmp
-
memory/640-119-0x0000000000C40000-0x0000000000C41000-memory.dmp
-
memory/640-118-0x0000000000000000-mapping.dmp
-
memory/640-117-0x000000000101A000-0x000000000101B000-memory.dmp
-
memory/816-125-0x0000000001030000-0x0000000001031000-memory.dmp
-
memory/816-122-0x0000000000000000-mapping.dmp
-
memory/816-120-0x0000000077AC2000-0x0000000077AC3000-memory.dmp
-
memory/816-121-0x0000000001015000-0x0000000001016000-memory.dmp
-
memory/816-124-0x0000000000C60000-0x0000000000C61000-memory.dmp
-
memory/1128-126-0x0000000077AC2000-0x0000000077AC3000-memory.dmp
-
memory/1128-128-0x0000000000000000-mapping.dmp
-
memory/1128-127-0x0000000000D71000-0x0000000000D72000-memory.dmp
-
memory/1728-146-0x0000000000000000-mapping.dmp
-
memory/1968-115-0x0000000000000000-mapping.dmp
-
memory/2084-134-0x0000000000000000-mapping.dmp
-
memory/2084-133-0x000000000101F000-0x0000000001020000-memory.dmp
-
memory/2084-132-0x0000000077AC2000-0x0000000077AC3000-memory.dmp
-
memory/2724-136-0x0000000077AC2000-0x0000000077AC3000-memory.dmp
-
memory/2724-138-0x0000000000000000-mapping.dmp
-
memory/2724-137-0x000000000101D000-0x000000000101E000-memory.dmp
-
memory/2776-142-0x0000000000000000-mapping.dmp
-
memory/2776-141-0x0000000000FB3000-0x0000000000FB4000-memory.dmp
-
memory/2776-140-0x0000000077AC2000-0x0000000077AC3000-memory.dmp
-
memory/4568-144-0x0000000000000000-mapping.dmp
-
memory/4664-147-0x0000021237920000-0x0000021237930000-memory.dmp
-
memory/4728-145-0x0000000000000000-mapping.dmp