https://modernsprinkler.filecloudonline.com/url/rpfggw2debhsdxic?shareto=pglennon@modernsprinkler.com

General
Target

https://modernsprinkler.filecloudonline.com/url/rpfggw2debhsdxic?shareto=pglennon@modernsprinkler.com

Filesize

N/A

Completed

26-11-2021 15:23

Score
4/10
Malware Config
Signatures 12

Filter: none

Defense Evasion
Discovery
  • Drops file in Windows directory
    MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exe

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\Windows\Debug\ESE.TXTMicrosoftEdge.exe
    File createdC:\Windows\rescache\_merged\3720402701\2274612954.priMicrosoftEdge.exe
    File createdC:\Windows\rescache\_merged\3720402701\2274612954.priMicrosoftEdgeCP.exe
    File opened for modificationC:\Windows\Debug\ESE.TXTMicrosoftEdge.exe
    File createdC:\Windows\rescache\_merged\3720402701\2274612954.priMicrosoftEdge.exe
    File createdC:\Windows\rescache\_merged\3720402701\2274612954.priMicrosoftEdgeCP.exe
  • HTTP links in PDF interactive object

    Description

    Detects HTTP links in interactive objects within PDF files.

    Tags

    Reported IOCs

    resourceyara_rule
    behavioral1/files/0x000500000001ac08-192.datpdf_with_link_action
  • Checks processor information in registry
    AcroRd32.exe

    Description

    Processor information is often read in order to detect sandboxing environments.

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key opened\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0AcroRd32.exe
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHzAcroRd32.exe
  • Modifies Internet Explorer Phishing Filter
    iexplore.exe

    TTPs

    Modify Registry

    Reported IOCs

    descriptioniocprocess
    Set value (data)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = d17a577ee8d1d701iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\PhishingFilteriexplore.exe
  • Modifies Internet Explorer settings
    IEXPLORE.EXEiexplore.exeMicrosoftEdge.exebrowser_broker.exeAcroRd32.exebrowser_broker.exeMicrosoftEdgeCP.exe

    TTPs

    Modify Registry

    Reported IOCs

    descriptioniocprocess
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearchIEXPLORE.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"IEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorageIEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\TotalIEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPageiexplore.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$bloggeriexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\modernsprinkler.filecloudonline.com\ = "161"IEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Mainiexplore.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\modernsprinkler.filecloudonline.comIEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\modernsprinkler.filecloudonline.com\ = "91"IEXPLORE.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"iexplore.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"IEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\filecloudonline.comIEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\MainMicrosoftEdge.exe
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\International\CpMRUIEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"IEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "91"IEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\filecloudonline.com\Total = "91"IEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsingiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Mainbrowser_broker.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\filecloudonline.com\NumberOfSubdomains = "1"IEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DomainSuggestioniexplore.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligentiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecoveryiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATIONAcroRd32.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002b5b008aa2024f4581a8e5e30df850c300000000020000000000106600000001000020000000cc043b2bb793ef1b4f6d024cb7aa6973133b71e49649789dd24b16d909dae797000000000e800000000200002000000010afc4cfcb1e365aa02208f3e1da854bb5cc674e79ee8d6dab5c021041b68ae420000000d2bf1cd3a2a46b54e2fa76f5cc0c0376355a36030fdc45f6acc20d72e76c1d0540000000bbf538e338685a9a85341eb14435b9e966018dcc0ca4f574cfc2416b5bea193e29391c4d4ffc0edd668d6a5d4fce9bc313d801d292ce248259bab4b41587372aiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNamesiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAheadiexplore.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz!iexplore.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWikiiexplore.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificateiexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearchiexplore.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002b5b008aa2024f4581a8e5e30df850c300000000020000000000106600000001000020000000e8c7f1c34c0878a5c1d55e2533d44792c53da97b94f2a012b83a054dda318c06000000000e8000000002000020000000f7c07ae5646c2dc3a13ceff3ff18c1adaa45a8f70fb3458afc22cc712acc871c200000002a3dbd03a298f8c216fb2637d26a2fe3a6a1bd25337bb45faed79368d8b7c1f4400000002729044ff7d9dd67d1c01dc23c55fda1ffe9d0a025dbd278f3b1497a4add222602b66badf91e817eef6897d64f685b5aadfe85b3a7383ea6970f299168f67925iexplore.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10f107fa04e2d701iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Mainbrowser_broker.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "344662428"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActiveiexplore.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511"iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "344630436"iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"IEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "161"IEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "344613842"iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F845E24A-5127-11EC-B34F-5ACFE0EDF3EA} = "0"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\MainIEXPLORE.EXE
    Set value (data)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80bf28fa04e2d701iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\MainMicrosoftEdgeCP.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"IEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\filecloudonline.com\Total = "161"IEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\RepIdiexplore.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\RepId\PublicId = "{2123B9F2-819F-461F-86F4-487DDD002EFD}"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Metaiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\iexplore.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPressiexplore.exe
  • Modifies registry class
    MicrosoftEdge.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

    Reported IOCs

    descriptioniocprocess
    Set value (str)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url2 = "https://login.aliexpress.com/"MicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"MicrosoftEdge.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 5c5f8b0805e2d701MicrosoftEdge.exe
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatusMicrosoftEdgeCP.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000MicrosoftEdgeCP.exe
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\FavoritesMicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0"MicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\InProgressFlags = "262144"MicrosoftEdge.exe
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUIMicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"MicrosoftEdge.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"MicrosoftEdgeCP.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\ManagerHistoryComplete = "1"MicrosoftEdge.exe
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\RecoveryMicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0"MicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0"MicrosoftEdge.exe
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\CTLsMicrosoftEdge.exe
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\Certificates\4EEF7FAF0062D34ABEMicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\AllComplete = "1"MicrosoftEdge.exe
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatusMicrosoftEdgeCP.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\Certificates\4EEF7FAF0062D34ABE = 0300000001000000140000004eef7faf0062d34abee6137e774438ae9988739f04000000010000001000000024d7172657e6b799f66cf32ae88b5c280f0000000100000020000000547b3c62613c9c2b025d5461623ae703e9853ee45a8bf3b425bf63528e992912140000000100000014000000fe7e60dd9d8292295edf1cf80869a75b98896ed01900000001000000100000002aac2185e0e1b6503eb16a495b1815fc5c0000000100000004000000000800001800000001000000100000002d581a49c8eb5b3b3c6ef9bb65314d702000000001000000eb050000308205e7308203cfa003020102021333000001a636dabe8bbe573d9a0000000001a6300d06092a864886f70d01010b0500307e310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312830260603550403131f4d6963726f736f667420536563757265205365727665722043412032303131301e170d3231303331313139323835325a170d3232303631313139323835325a3081a9310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b130442696e67311b301906035504031312494520496e737472756d656e746174696f6e3127302506092a864886f70d010901161862696e6769657465616d406d6963726f736f66742e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100d0b49f5b650f0fa690df343367a2cd62155e98e3c0fc14cb1f696618be8c327ef257f50d47bce3a4286e36edc0382e0ac81096dbce62463bb552970d01d02a7ca642d6faed9b5878c4e2e33e7c9f94ea4eb7f125662d5d2fe78138ce3e827bd98969028a908fab20632542a1ef952c10382b7efcaae1f5e7521d5fb617a93aa002b579a3203726111c73a9832712e3b5d4d140b247c91824de8123b45ea39fbcdb6e5c77d68cd3db64dd24844a1879865356f655cf1c5d94b208e244bd075a9823c87af7bcad6aab52e3444aad2947a7baad0d42c9d785964dbd8b4e09004359094d0646c3ca98e7c698b0fa7d6f1606b1459fd6df8d9aea8ae85911789bc5e10203010001a38201303082012c300e0603551d0f0101ff0404030204f030150603551d25040e300c060a2b0601040182374c0c01301d0603551d0e04160414fe7e60dd9d8292295edf1cf80869a75b98896ed0301f0603551d230418301680143656896549cb5b9b2f3cac4216504d91b933d79130530603551d1f044c304a3048a046a0448642687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b696f70732f63726c2f4d69635365635365724341323031315f323031312d31302d31382e63726c306006082b0601050507010104543052305006082b060105050730028644687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b696f70732f63657274732f4d69635365635365724341323031315f323031312d31302d31382e637274300c0603551d130101ff04023000300d06092a864886f70d01010b05000382020100c1055e1c6ece899cbff031668bd0b72ee668484f9392c48efe112ba21c521af47582849539f2fd53f7f8adecc243743211150de90b106e6bdaaedb88a8fc71aff2bd4bfeae5628507aa3b47095bf680a0a56bc6cb9c70871fa0b05857bf1762af884469264870c4139f7f9e93bbedaf73a867994c51e7c8473506f1ca68a8f9059cfa5c068be7ecade98315eebd7e71431ebe7d033b4fc8056d94ab70b03e1368082fc83a82cd632b9f3a03f9c9d51881c39b432ee9856e87835bc0481e57489da3590d20b2b9b0900704de861f994d956a2c0347178c59e5048bb9bbfbe8cef237d5860d7f407dcbce486eee7d98a90509a8f1b81445453326b139f0d2fdc68b831681fa96f2284b8153e3dbe60cb2d0ac030d0e2ecfc85c9d361c25e01cabe57cd6ebdc40708b2bd449152e90d2d45d725db856ab64d29a9fdb9fdb85f6354cbd5be240f4b71fa745db8eb32c0e4ea4747bfa5a4f9a5346e42b3379636d05e52225cea1baa7792b8f51b803658026b11fd0ab5877a99f4e74ff994c61177ea425554a7135d8b020661d2d285eb8bf1aa00d3bf78e2f5dba62cd7befdb85fffe6c1b65643f56fe36cf412f366b03bc8c78c852c1ed43a218256636d67eb8241477d3258af4f96b9698b0326d6d01826734eb18f1b393cbf85c0f9fdab4fb854536110f2f678003f80f270cbb1fbeb5ba09523f959dfeba84319577874e4dec0MicrosoftEdge.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\MigrationTime = 79f0e5fcadd1d701MicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\FontSize = "3"MicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0"MicrosoftEdge.exe
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\ZonesMicrosoftEdge.exe
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingDeleteMicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"MicrosoftEdge.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$Discuz!MicrosoftEdge.exe
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\ActiveMicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"MicrosoftEdgeCP.exe
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Extensible CacheMicrosoftEdgeCP.exe
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\CookiesMicrosoftEdge.exe
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\CacheMicrosoftEdgeCP.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CacheLimit = "1"MicrosoftEdgeCP.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "1"MicrosoftEdge.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000MicrosoftEdgeCP.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefixMicrosoftEdgeCP.exe
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsingMicrosoftEdgeCP.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 1a83102305e2d701MicrosoftEdge.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$TelligentMicrosoftEdge.exe
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CertificatesMicrosoftEdge.exe
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\CRLsMicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"MicrosoftEdge.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\UUID = "{71F6D5DE-8206-46E6-A90C-5A4BF5CBE026}"MicrosoftEdge.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 943a460805e2d701MicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "268435456"MicrosoftEdge.exe
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsingMicrosoftEdge.exe
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatusMicrosoftEdgeCP.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"MicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"MicrosoftEdge.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000MicrosoftEdgeCP.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 33595efd04e2d701MicrosoftEdge.exe
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\MainMicrosoftEdgeCP.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\ClearBrowsingHistoryOnStart = "0"MicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{017DE533-1F5D-4C93-85A4-F309BA57F60A} = "0"MicrosoftEdge.exe
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\MainMicrosoftEdge.exe
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\CTLsMicrosoftEdge.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = c51e600e05e2d701MicrosoftEdge.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = dd17301d05e2d701MicrosoftEdge.exe
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CertificatesMicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"MicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"MicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0"MicrosoftEdge.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000MicrosoftEdgeCP.exe
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsingMicrosoftEdgeCP.exe
  • Suspicious behavior: MapViewOfSection
    MicrosoftEdgeCP.exe

    Reported IOCs

    pidprocess
    5040MicrosoftEdgeCP.exe
    5040MicrosoftEdgeCP.exe
  • Suspicious use of AdjustPrivilegeToken
    MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege596MicrosoftEdge.exe
    Token: SeDebugPrivilege596MicrosoftEdge.exe
    Token: SeDebugPrivilege596MicrosoftEdge.exe
    Token: SeDebugPrivilege596MicrosoftEdge.exe
    Token: SeDebugPrivilege4444MicrosoftEdgeCP.exe
    Token: SeDebugPrivilege4444MicrosoftEdgeCP.exe
    Token: SeDebugPrivilege4444MicrosoftEdgeCP.exe
    Token: SeDebugPrivilege4444MicrosoftEdgeCP.exe
    Token: SeDebugPrivilege596MicrosoftEdge.exe
    Token: SeDebugPrivilege4060MicrosoftEdgeCP.exe
    Token: SeDebugPrivilege4060MicrosoftEdgeCP.exe
  • Suspicious use of FindShellTrayWindow
    iexplore.exeAcroRd32.exe

    Reported IOCs

    pidprocess
    2604iexplore.exe
    2604iexplore.exe
    1852AcroRd32.exe
  • Suspicious use of SendNotifyMessage
    AcroRd32.exe

    Reported IOCs

    pidprocess
    1852AcroRd32.exe
    1852AcroRd32.exe
    1852AcroRd32.exe
    1852AcroRd32.exe
    1852AcroRd32.exe
    1852AcroRd32.exe
    1852AcroRd32.exe
    1852AcroRd32.exe
    1852AcroRd32.exe
    1852AcroRd32.exe
    1852AcroRd32.exe
    1852AcroRd32.exe
    1852AcroRd32.exe
    1852AcroRd32.exe
  • Suspicious use of SetWindowsHookEx
    iexplore.exeIEXPLORE.EXEAcroRd32.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exe

    Reported IOCs

    pidprocess
    2604iexplore.exe
    2604iexplore.exe
    2616IEXPLORE.EXE
    2616IEXPLORE.EXE
    2616IEXPLORE.EXE
    2616IEXPLORE.EXE
    2616IEXPLORE.EXE
    2616IEXPLORE.EXE
    2616IEXPLORE.EXE
    2616IEXPLORE.EXE
    2616IEXPLORE.EXE
    2616IEXPLORE.EXE
    1852AcroRd32.exe
    1852AcroRd32.exe
    1852AcroRd32.exe
    1852AcroRd32.exe
    1852AcroRd32.exe
    596MicrosoftEdge.exe
    4364MicrosoftEdgeCP.exe
    4364MicrosoftEdgeCP.exe
    4780MicrosoftEdge.exe
    5040MicrosoftEdgeCP.exe
    5040MicrosoftEdgeCP.exe
  • Suspicious use of WriteProcessMemory
    iexplore.exeAcroRd32.exeRdrCEF.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 2604 wrote to memory of 26162604iexplore.exeIEXPLORE.EXE
    PID 2604 wrote to memory of 26162604iexplore.exeIEXPLORE.EXE
    PID 2604 wrote to memory of 26162604iexplore.exeIEXPLORE.EXE
    PID 2604 wrote to memory of 18522604iexplore.exeAcroRd32.exe
    PID 2604 wrote to memory of 18522604iexplore.exeAcroRd32.exe
    PID 2604 wrote to memory of 18522604iexplore.exeAcroRd32.exe
    PID 1852 wrote to memory of 36321852AcroRd32.exeRdrCEF.exe
    PID 1852 wrote to memory of 36321852AcroRd32.exeRdrCEF.exe
    PID 1852 wrote to memory of 36321852AcroRd32.exeRdrCEF.exe
    PID 1852 wrote to memory of 10841852AcroRd32.exeLaunchWinApp.exe
    PID 1852 wrote to memory of 10841852AcroRd32.exeLaunchWinApp.exe
    PID 1852 wrote to memory of 10841852AcroRd32.exeLaunchWinApp.exe
    PID 3632 wrote to memory of 37323632RdrCEF.exeRdrCEF.exe
    PID 3632 wrote to memory of 37323632RdrCEF.exeRdrCEF.exe
    PID 3632 wrote to memory of 37323632RdrCEF.exeRdrCEF.exe
    PID 3632 wrote to memory of 37323632RdrCEF.exeRdrCEF.exe
    PID 3632 wrote to memory of 37323632RdrCEF.exeRdrCEF.exe
    PID 3632 wrote to memory of 37323632RdrCEF.exeRdrCEF.exe
    PID 3632 wrote to memory of 37323632RdrCEF.exeRdrCEF.exe
    PID 3632 wrote to memory of 37323632RdrCEF.exeRdrCEF.exe
    PID 3632 wrote to memory of 37323632RdrCEF.exeRdrCEF.exe
    PID 3632 wrote to memory of 37323632RdrCEF.exeRdrCEF.exe
    PID 3632 wrote to memory of 37323632RdrCEF.exeRdrCEF.exe
    PID 3632 wrote to memory of 37323632RdrCEF.exeRdrCEF.exe
    PID 3632 wrote to memory of 37323632RdrCEF.exeRdrCEF.exe
    PID 3632 wrote to memory of 37323632RdrCEF.exeRdrCEF.exe
    PID 3632 wrote to memory of 37323632RdrCEF.exeRdrCEF.exe
    PID 3632 wrote to memory of 37323632RdrCEF.exeRdrCEF.exe
    PID 3632 wrote to memory of 37323632RdrCEF.exeRdrCEF.exe
    PID 3632 wrote to memory of 37323632RdrCEF.exeRdrCEF.exe
    PID 3632 wrote to memory of 37323632RdrCEF.exeRdrCEF.exe
    PID 3632 wrote to memory of 37323632RdrCEF.exeRdrCEF.exe
    PID 3632 wrote to memory of 37323632RdrCEF.exeRdrCEF.exe
    PID 3632 wrote to memory of 37323632RdrCEF.exeRdrCEF.exe
    PID 3632 wrote to memory of 37323632RdrCEF.exeRdrCEF.exe
    PID 3632 wrote to memory of 37323632RdrCEF.exeRdrCEF.exe
    PID 3632 wrote to memory of 37323632RdrCEF.exeRdrCEF.exe
    PID 3632 wrote to memory of 37323632RdrCEF.exeRdrCEF.exe
    PID 3632 wrote to memory of 37323632RdrCEF.exeRdrCEF.exe
    PID 3632 wrote to memory of 37323632RdrCEF.exeRdrCEF.exe
    PID 3632 wrote to memory of 37323632RdrCEF.exeRdrCEF.exe
    PID 3632 wrote to memory of 37323632RdrCEF.exeRdrCEF.exe
    PID 3632 wrote to memory of 37323632RdrCEF.exeRdrCEF.exe
    PID 3632 wrote to memory of 37323632RdrCEF.exeRdrCEF.exe
    PID 3632 wrote to memory of 37323632RdrCEF.exeRdrCEF.exe
    PID 3632 wrote to memory of 37323632RdrCEF.exeRdrCEF.exe
    PID 3632 wrote to memory of 37323632RdrCEF.exeRdrCEF.exe
    PID 3632 wrote to memory of 37323632RdrCEF.exeRdrCEF.exe
    PID 3632 wrote to memory of 37323632RdrCEF.exeRdrCEF.exe
    PID 3632 wrote to memory of 37323632RdrCEF.exeRdrCEF.exe
    PID 3632 wrote to memory of 37323632RdrCEF.exeRdrCEF.exe
    PID 3632 wrote to memory of 37323632RdrCEF.exeRdrCEF.exe
    PID 3632 wrote to memory of 37323632RdrCEF.exeRdrCEF.exe
    PID 3632 wrote to memory of 37323632RdrCEF.exeRdrCEF.exe
    PID 3632 wrote to memory of 37323632RdrCEF.exeRdrCEF.exe
    PID 3632 wrote to memory of 12563632RdrCEF.exeRdrCEF.exe
    PID 3632 wrote to memory of 12563632RdrCEF.exeRdrCEF.exe
    PID 3632 wrote to memory of 12563632RdrCEF.exeRdrCEF.exe
    PID 3632 wrote to memory of 12563632RdrCEF.exeRdrCEF.exe
    PID 3632 wrote to memory of 12563632RdrCEF.exeRdrCEF.exe
    PID 3632 wrote to memory of 12563632RdrCEF.exeRdrCEF.exe
    PID 3632 wrote to memory of 12563632RdrCEF.exeRdrCEF.exe
    PID 3632 wrote to memory of 12563632RdrCEF.exeRdrCEF.exe
    PID 3632 wrote to memory of 12563632RdrCEF.exeRdrCEF.exe
Processes 24
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://modernsprinkler.filecloudonline.com/url/rpfggw2debhsdxic?shareto=pglennon@modernsprinkler.com
    Modifies Internet Explorer Phishing Filter
    Modifies Internet Explorer settings
    Suspicious use of FindShellTrayWindow
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    PID:2604
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2604 CREDAT:82945 /prefetch:2
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2616
    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LOEA0KPG\New Document.pdf"
      Checks processor information in registry
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1852
      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
        Suspicious use of WriteProcessMemory
        PID:3632
        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=B7B66D934390402253F2A09A9A2A69E6 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=B7B66D934390402253F2A09A9A2A69E6 --renderer-client-id=2 --mojo-platform-channel-handle=1648 --allow-no-sandbox-job /prefetch:1
          PID:3732
        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=63A4436B173D64ECFDD959D62392AC5A --mojo-platform-channel-handle=1764 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
          PID:1256
        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=7CCC9F6173FA10E2697C2FB23B9ACA0D --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=7CCC9F6173FA10E2697C2FB23B9ACA0D --renderer-client-id=4 --mojo-platform-channel-handle=2084 --allow-no-sandbox-job /prefetch:1
          PID:1368
        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=784450833E083CC078364C4865BF3766 --mojo-platform-channel-handle=2588 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
          PID:3212
        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2B12C3D6FD49F6C73DF3C12348FA9ACE --mojo-platform-channel-handle=2716 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
          PID:2592
        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F4CB783299F73B9E72AF1CF97926B53E --mojo-platform-channel-handle=2596 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
          PID:4112
      • C:\Windows\SysWOW64\LaunchWinApp.exe
        "C:\Windows\system32\LaunchWinApp.exe" "https://gaudy-frill-cicada.glitch.me/docss.html"
        PID:1084
      • C:\Windows\SysWOW64\LaunchWinApp.exe
        "C:\Windows\system32\LaunchWinApp.exe" "https://gaudy-frill-cicada.glitch.me/docss.html"
        PID:1480
      • C:\Windows\SysWOW64\LaunchWinApp.exe
        "C:\Windows\system32\LaunchWinApp.exe" "https://gaudy-frill-cicada.glitch.me/docss.html"
        PID:4732
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
    Drops file in Windows directory
    Modifies Internet Explorer settings
    Modifies registry class
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of SetWindowsHookEx
    PID:596
  • C:\Windows\system32\browser_broker.exe
    C:\Windows\system32\browser_broker.exe -Embedding
    Modifies Internet Explorer settings
    PID:1152
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    Modifies registry class
    Suspicious use of SetWindowsHookEx
    PID:4364
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    Drops file in Windows directory
    Modifies Internet Explorer settings
    Modifies registry class
    Suspicious use of AdjustPrivilegeToken
    PID:4444
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
    Drops file in Windows directory
    Modifies registry class
    Suspicious use of SetWindowsHookEx
    PID:4780
  • C:\Windows\system32\browser_broker.exe
    C:\Windows\system32\browser_broker.exe -Embedding
    Modifies Internet Explorer settings
    PID:4828
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    Modifies registry class
    Suspicious behavior: MapViewOfSection
    Suspicious use of SetWindowsHookEx
    PID:5040
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    Drops file in Windows directory
    Modifies registry class
    PID:5104
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    PID:4636
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    Modifies registry class
    PID:4444
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    Modifies registry class
    Suspicious use of AdjustPrivilegeToken
    PID:4060
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Persistence
                    Privilege Escalation
                      Replay Monitor
                      00:00 00:00
                      Downloads
                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

                        MD5

                        f38465988ba273bb822b84568d682669

                        SHA1

                        566d8520422def07cdd88475317401d28aafb381

                        SHA256

                        94f64b5a32e13b896b8cefb103757a4e4ae5d1c4df3f4ce6a8f0747e83ce5d7d

                        SHA512

                        68796c406f4cada9e11a467f4aea3d8e6555173c94a125b93e06219139b983c813f94d6da98b0849e01e26255ef16d10274d9e67aaca3aaa77e35b6ac64a52a4

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9EF5B6E8FB46B63DFD6A93EC1E0743AE

                        MD5

                        633f235fe42aea2d5782ae8be19acaad

                        SHA1

                        53abeb6f84b482dcd234ffed85901e4b84beb863

                        SHA256

                        eb2cf094709037d4ed392490fd1c143ae62f215893ef586af3c2ccd6ec4358fb

                        SHA512

                        615f335e452a724e2012dda21769cd6cdd1ce52b6a898cc0f4587f26ebe1859a488211ec133481678f060c0be55ac63710102143833b9c38dde9c2757e73aae2

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

                        MD5

                        bb5b6bfd10c107593232ff1254853e03

                        SHA1

                        0a8a2aa6efec37e8b425a91c90f27d9de1b125e9

                        SHA256

                        6783b1f10f27824de2708f3eec3d1d0e080ce94457b256afd8f6ce1409e6e8ba

                        SHA512

                        48973f31f7fcd5795fdfefb63fb5e6b41a375dc57b57052f632f6a8fecf47ae6ba90fafb0946a28b7b631c40095c1b8ad62cef20ce8a2111af5a750425519bf4

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

                        MD5

                        21d6b5c745d3b6085d1e43644122697b

                        SHA1

                        78836e10550b8e9fc53c333688ca0ff8a261b564

                        SHA256

                        43214c58d3d9f8f36f1257f6a65f97643cad33d62973404941b424ec8bcbb7db

                        SHA512

                        24047ff90613355cd08fe0682186d10b6562c909f3cf0822887ef4179cef806188bf742c7d6de8ebd21f2ba40a40bca8f187d47393debb63cdf6bef9f37528dd

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9EF5B6E8FB46B63DFD6A93EC1E0743AE

                        MD5

                        010c0750f60dd65281f4547f68203b03

                        SHA1

                        9051eb0837c5374eb7c1f78869132ee3f9f52722

                        SHA256

                        87be8301fe4fffe2ba2c3eea2830aaa43134e7522e87ed93ed4a1a0dc10718a5

                        SHA512

                        6ebf91ba1d32b351b8b2ec7c04a095f6191e36e3e659e87dd14b7d7ae7da707674e472b1e49b43dd3b19e78bd5a2bdb8f4c79357d53db8b93c8e112a6f6c4e36

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

                        MD5

                        e928985644211c8391ce8de3803a039c

                        SHA1

                        d53aef9d858f9b4ae99fd6554fe802a1e404973e

                        SHA256

                        5458a1a1075ee8588c396fca62e34927f4333307d0e1866140dfae7667ea4949

                        SHA512

                        900de3dbe2731e6d588aa9c78d53b268d71d9a5833a1cde682ac7dccab1c08b9d4aa9f8227c2f6543b5e58451ae97f453b7aa257d92cd20f5ea45668c9671c4d

                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LOEA0KPG\New Document.pdf.mc6vig9.partial

                        MD5

                        85284e6807b343b6b0fa97bdaa2e8496

                        SHA1

                        45eb42ce0d026576648bffe3bde3443b92aa1ec8

                        SHA256

                        93f1ed4c3e443d8775cf599c4b524fd6093694227e473b715d92d2bff96ac2f4

                        SHA512

                        b08fddd647215aadf036bbde98742cb6fe03af80d98c944e42c9b7b6a25e1a13fa08634fc8e9a5e8c328083a12b95f102c33eb0ea4b65d4a38408c732478e3db

                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\BXA27D8P.cookie

                        MD5

                        9f5bd734809a8ca0ba93f945f51a648a

                        SHA1

                        f67563329b48e14e8378826db358f4ab31fc99a4

                        SHA256

                        895b51a98a763d14a988e18f64ce37a47d20313f998699828d7bf828428fede0

                        SHA512

                        c69175b30ad4381d53fdc6f1f4bbe795c9b1bfb5ef07c3eff92d527e781841292a3887c7438e7d35efba8ea3fdb36e158f7bbe86134b3fce376398905b5b8397

                      • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_93E4B2BA79A897B3100CCB27F2D3BF4F

                        MD5

                        e0fcf3ca705ff9b6741c7b3c02515030

                        SHA1

                        356156e982ffaaa96a480aa6bf64a6f64aab5d82

                        SHA256

                        aaf5395847b70c0e0b3e32fa3d388c9acb027db24204ba61562dab9477907ed6

                        SHA512

                        273347b22a6ddb3e8f4e8051dc20e640ecb3661899e274963cef08d8a5aa2b80894244928c9464f55fcfe74ad16010b54f995d13d0525702d349c4fd1afc901b

                      • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62

                        MD5

                        870dcdfa06bfbce6120d7d7eeaa440a1

                        SHA1

                        49a42acbc21120bf83e105363632017502b6370a

                        SHA256

                        b511716918619bdefa6440b53708f385f24b76c747ec1ac9420916b3cc7aba9c

                        SHA512

                        40b2bb983d4005d20873803d41c0b808c6c3275dc7a5bf741bb4e12acb7dcf5f82074e79a1d49563020a8ea1a98ccf88ea746e7bcabb0f22812307ff362aaf18

                      • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

                        MD5

                        d1d6e2d8fd72f8e7b6a0f544765023f2

                        SHA1

                        db07e90515b9dc6e094acb4f27584df14be801ef

                        SHA256

                        2a9c32cf065f7d2df8c8b1d152a1c8409563107c691e91492a60a839b713e7b7

                        SHA512

                        7dc9b6c79c421990ea054018a63e9d6beeca6f23c81d1bac6382117e7be8aba071b275c536fe2daa2e8ec0376c016a71003a5d5c84fab77673375bc395ff4237

                      • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\FC5A820A001B41D68902E051F36A5282_30F701A5D3F3E340D2DF9758F7784007

                        MD5

                        d6f7dd1defd4d75cbd7cf7339d20483a

                        SHA1

                        ee2597a04cd3785ae7e8fb4fe54d54e794ad4504

                        SHA256

                        1638b57742052d565c1bf826bffd45723806d07eb7b2cda373d9c2069dd3dbff

                        SHA512

                        a5e107fc86d99562ebcf38cd8507a3202b8fcfff91862e8427c07b4536ceca9e96fdc5738e729b59143529792bac670dfeec935f8c3722dd667a20b21485a608

                      • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_93E4B2BA79A897B3100CCB27F2D3BF4F

                        MD5

                        40127db194c31613beef6790cc7cd0ef

                        SHA1

                        db73f8ffa6ff3e3a8d39fea2fb0aa895f12b1e67

                        SHA256

                        0732e7ce891ef9ddc09ea3c523311cbe64670640dbd94d7bc42186f6e90ddba3

                        SHA512

                        10f9e4937bdf331628726d53d93fbf8c4136005b7a7254fd88e4534a4da5bbdbdd2608efa1e5e79b64fe00fd811e3c2bb671fe05f18345ff0db07769880692da

                      • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62

                        MD5

                        33f15bb1fe7ac60304376cf985599c27

                        SHA1

                        a2fd6e1cb0c764409a1b6a90175ac9389c05168f

                        SHA256

                        1e0facace17af51ba1464c2fa51aac736faba502d416db29d511076569f6b758

                        SHA512

                        e1f7349e0a2349f3c8c89f58c6a1fae74fd3a5ab21163906b5bd2aedefe83e2281d1b3c7d77701fad600221b02464eaa4b4a4ce47c53aa5dfc881b0815049fd4

                      • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

                        MD5

                        ceae9b8156b5097c71a150bdaec3037c

                        SHA1

                        c36260be8c059cb7e70ba6505a1c2c527654ffbc

                        SHA256

                        2e5376d419e789281521588818a696f6effb62e90056964f7a6a9bf484648b2f

                        SHA512

                        54b418d241f45262eb30efd9bb005a24aabeab211e151e6466c3e036f8026da375ef9258fd574ae5b56a03b47ceaafff3a735de17020d3f1e688207e56709df0

                      • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\FC5A820A001B41D68902E051F36A5282_30F701A5D3F3E340D2DF9758F7784007

                        MD5

                        8171b319a29754ed6813632c7ddccd9a

                        SHA1

                        4b4903715d03ea6660d5ee55e4bee8487a4a043b

                        SHA256

                        4182bcd2e577a16096840217e63ec63e5affc1a302c43c0d96ba01de6a5ba61f

                        SHA512

                        0be14f5c69f7af51963776a0e741b848788578daaea8ab819722557b5fa91880e51a44b15ac9894488cb48fc25d30d72de79412e9bb4d8ad7c9ec37eaa74a4e5

                      • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\Windows\3720402701\2274612954.pri

                        MD5

                        0db264b38ac3c5f6c140ba120a7fe72f

                        SHA1

                        51aa2330c597e84ed3b0d64bf6b73bf6b15f9d74

                        SHA256

                        2f6955b0f5277a7904c59e461bfa6b06c54fece0d7c11f27408fa7a281a4556d

                        SHA512

                        3534c243516cef5cee0540d5efd5cde1f378e127e6013b5e309a2e0be8393417bfe458706564b4b955f92132a51e2772c67f9fd90441476cc3512a5d9f910d84

                      • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\LogFiles\edb.log

                        MD5

                        2d314e879e875d8a54872b9c9db664b5

                        SHA1

                        ca7f785a60a70cef3f3f57cb53d624447a09ee69

                        SHA256

                        ac5cc74d434b75197871fe28bf9db43041caa9a0032afcc842df8175edb4656e

                        SHA512

                        ac8f2e2966eca822ea825cfa4f858a95ee1ad52c7c19cd3991c6dee86facf182cc3808391c14d2345b090600fc06265878141df2538e129d4c59a8d085d1bfb0

                      • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\edb.chk

                        MD5

                        5356b6677b027eb8fd4e36a39c189e51

                        SHA1

                        27191eeb2d923440e7c84bcbfde7e7b9170bf361

                        SHA256

                        f10ece336ea1831e20caddd2891ccbde6fb29b4a13d4d94059170f250dd9ed8f

                        SHA512

                        da658519720deecfc8330abf87f01f07bba746c89518a9f21a7aefa1f043f7c81a4c2ef79c8da4152e183a4ad96709cab0493e9cf0bd90a09450df776fb6b0b1

                      • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\spartan.edb

                        MD5

                        21e6ffa689d05a7035f994703cc3418b

                        SHA1

                        e8465a9fb605c9cb9a878cfe41d99147eeef9e1f

                        SHA256

                        9f8f0aeba00c955dbc883761c2503aa89a411432bc4894ea6e181bbd0a06bdc2

                        SHA512

                        4c32eb8acf7805ebb47035d972ab1b8ae1eb3a7a3511fee480af34ba85cde6ef1931e65e1ffbe4e5573c1f60c289beb8c199f4cf4d4c4c4717cdb33979d8ffb8

                      • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\spartan.jfm

                        MD5

                        5164739cfac77453f25dec1ac5aa5c92

                        SHA1

                        556c1e59d7e207e52b37f4e7ae9032a3c650613d

                        SHA256

                        631e911eeb8dcbf95e5e17c9cf069eb1814c8d1ee56b82fe5e6fb628a025159d

                        SHA512

                        36cdcb1946357a713b4f08116edec435ca9bdf80f33a2fd935d3d7bb3820efe3eac451b8d70f59f33a13402312d07c75acf6741b952f6bed3e405480d34d196b

                      • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\Recovery\Active\RecoveryStore.{29E97694-0618-4E59-B842-F7EBB2BD4C45}.dat

                        MD5

                        e5642cafa3884d88cb69dddb0a1c992a

                        SHA1

                        b6995139c638eb7c92db538dd1390eda59a232e6

                        SHA256

                        b906ec5c52a0f877604d9c61180acf5ac06efba08a031b291e272b00cc478153

                        SHA512

                        1589d7b4b720b1d4635c2e33ace36010f0602db7696a457d0ae49024df50508c23798a4775911daebc92c6e5797a09b556fd5618a451eb41c433a31e419d2551

                      • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\Recovery\Active\{E5D21B6D-87F8-433B-8D0E-AE461C2B7343}.dat

                        MD5

                        16f0cad7d07c82e61b7be26aaade7638

                        SHA1

                        b0f7f3906fc12adab13d545943a8c6866a369ae9

                        SHA256

                        a3b6f380bc67d0af22b882db6647da0dffb50beda8df07194c5deac875796c22

                        SHA512

                        285294c7b1ba7d605dcbba3bc5b445d6f67ae806edee7ed082f05987f598be58ee251d616484e798606914df344ce94b99c93042f2e11f4dc50b5c680ec8d76c

                      • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\Microsoft\Windows\3720402701\2274612954.pri

                        MD5

                        0db264b38ac3c5f6c140ba120a7fe72f

                        SHA1

                        51aa2330c597e84ed3b0d64bf6b73bf6b15f9d74

                        SHA256

                        2f6955b0f5277a7904c59e461bfa6b06c54fece0d7c11f27408fa7a281a4556d

                        SHA512

                        3534c243516cef5cee0540d5efd5cde1f378e127e6013b5e309a2e0be8393417bfe458706564b4b955f92132a51e2772c67f9fd90441476cc3512a5d9f910d84

                      • memory/1084-219-0x0000000000000000-mapping.dmp

                      • memory/1256-228-0x0000000000000000-mapping.dmp

                      • memory/1368-232-0x0000000000000000-mapping.dmp

                      • memory/1480-236-0x0000000000000000-mapping.dmp

                      • memory/1852-210-0x0000000000000000-mapping.dmp

                      • memory/2592-243-0x0000000000000000-mapping.dmp

                      • memory/2604-153-0x00007FFF12D50000-0x00007FFF12DBB000-memory.dmp

                      • memory/2604-160-0x00007FFF12D50000-0x00007FFF12DBB000-memory.dmp

                      • memory/2604-166-0x00007FFF12D50000-0x00007FFF12DBB000-memory.dmp

                      • memory/2604-167-0x00007FFF12D50000-0x00007FFF12DBB000-memory.dmp

                      • memory/2604-168-0x00007FFF12D50000-0x00007FFF12DBB000-memory.dmp

                      • memory/2604-158-0x00007FFF12D50000-0x00007FFF12DBB000-memory.dmp

                      • memory/2604-170-0x00007FFF12D50000-0x00007FFF12DBB000-memory.dmp

                      • memory/2604-171-0x00007FFF12D50000-0x00007FFF12DBB000-memory.dmp

                      • memory/2604-172-0x00007FFF12D50000-0x00007FFF12DBB000-memory.dmp

                      • memory/2604-154-0x00007FFF12D50000-0x00007FFF12DBB000-memory.dmp

                      • memory/2604-174-0x00007FFF12D50000-0x00007FFF12DBB000-memory.dmp

                      • memory/2604-177-0x00007FFF12D50000-0x00007FFF12DBB000-memory.dmp

                      • memory/2604-181-0x00007FFF12D50000-0x00007FFF12DBB000-memory.dmp

                      • memory/2604-169-0x00007FFF12D50000-0x00007FFF12DBB000-memory.dmp

                      • memory/2604-152-0x00007FFF12D50000-0x00007FFF12DBB000-memory.dmp

                      • memory/2604-150-0x00007FFF12D50000-0x00007FFF12DBB000-memory.dmp

                      • memory/2604-148-0x00007FFF12D50000-0x00007FFF12DBB000-memory.dmp

                      • memory/2604-147-0x00007FFF12D50000-0x00007FFF12DBB000-memory.dmp

                      • memory/2604-173-0x00007FFF12D50000-0x00007FFF12DBB000-memory.dmp

                      • memory/2604-145-0x00007FFF12D50000-0x00007FFF12DBB000-memory.dmp

                      • memory/2604-144-0x00007FFF12D50000-0x00007FFF12DBB000-memory.dmp

                      • memory/2604-141-0x00007FFF12D50000-0x00007FFF12DBB000-memory.dmp

                      • memory/2604-140-0x00007FFF12D50000-0x00007FFF12DBB000-memory.dmp

                      • memory/2604-139-0x00007FFF12D50000-0x00007FFF12DBB000-memory.dmp

                      • memory/2604-138-0x00007FFF12D50000-0x00007FFF12DBB000-memory.dmp

                      • memory/2604-136-0x00007FFF12D50000-0x00007FFF12DBB000-memory.dmp

                      • memory/2604-135-0x00007FFF12D50000-0x00007FFF12DBB000-memory.dmp

                      • memory/2604-134-0x00007FFF12D50000-0x00007FFF12DBB000-memory.dmp

                      • memory/2604-132-0x00007FFF12D50000-0x00007FFF12DBB000-memory.dmp

                      • memory/2604-131-0x00007FFF12D50000-0x00007FFF12DBB000-memory.dmp

                      • memory/2604-130-0x00007FFF12D50000-0x00007FFF12DBB000-memory.dmp

                      • memory/2604-128-0x00007FFF12D50000-0x00007FFF12DBB000-memory.dmp

                      • memory/2604-126-0x00007FFF12D50000-0x00007FFF12DBB000-memory.dmp

                      • memory/2604-125-0x00007FFF12D50000-0x00007FFF12DBB000-memory.dmp

                      • memory/2604-124-0x00007FFF12D50000-0x00007FFF12DBB000-memory.dmp

                      • memory/2604-123-0x00007FFF12D50000-0x00007FFF12DBB000-memory.dmp

                      • memory/2604-122-0x00007FFF12D50000-0x00007FFF12DBB000-memory.dmp

                      • memory/2604-120-0x00007FFF12D50000-0x00007FFF12DBB000-memory.dmp

                      • memory/2604-119-0x00007FFF12D50000-0x00007FFF12DBB000-memory.dmp

                      • memory/2604-127-0x00007FFF12D50000-0x00007FFF12DBB000-memory.dmp

                      • memory/2604-159-0x00007FFF12D50000-0x00007FFF12DBB000-memory.dmp

                      • memory/2604-118-0x00007FFF12D50000-0x00007FFF12DBB000-memory.dmp

                      • memory/2616-143-0x0000000000000000-mapping.dmp

                      • memory/3212-239-0x0000000000000000-mapping.dmp

                      • memory/3632-218-0x0000000000000000-mapping.dmp

                      • memory/3732-222-0x0000000000000000-mapping.dmp

                      • memory/4112-247-0x0000000000000000-mapping.dmp

                      • memory/4732-250-0x0000000000000000-mapping.dmp