5eca3657e7b3280fd41be9780b381245369e6101a5e30a79607104111cf3ea5b

Analysis

max time kernel
102s
max time network
104s
platform
windows10_x64
resource
win10-en-20211208
submitted
09-12-2021 18:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

COVID-19.pdf
Size

138KB
MD5

7c72b0220709ea6679124397b2357173
SHA1

52deb98a2be1d6448c194e50296887332110dd23
SHA256

5eca3657e7b3280fd41be9780b381245369e6101a5e30a79607104111cf3ea5b
SHA512

8745a9e24be2bbb7d20c2cf527362c99b2eb10fee290e46de0b6451daf8c1ff3ed760bbf639df66cf3007a3c5a324832697c43757ea58bb9248c15fb594d305d

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 5 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
File created	C:\Windows\rescache\_merged\3720402701\1659841449.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1659841449.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1659841449.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1659841449.pri	MicrosoftEdgeCP.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exeMicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState\EdpCleanupState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "127"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "36604"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "36624"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\youtube.com\Total = "19810"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.youtube.com\ = "293"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.youtube.com	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "26679"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\InternetRegistry	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\opentext.com\Total = "36"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\www.who.int	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\youtube.com\Total = "11739"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\DatabaseComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 55149cb689efd701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.youtube.com\ = "1860"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "29255"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\youtube.com\Total = "2602"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.youtube.com\ = "9960"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.who.int\ = "13"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\youtube.com\Total = "19499"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\youtube.com\Total = "19416"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\opentext.com\Total = "22"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\youtube.com\Total = "6"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "36522"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\youtube.com\Total = "293"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\OneTimeCleanup = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.youtube.com\ = "1778"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\youtube.com\Total = "10160"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\opentext.com	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "127"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\www.youtube.com	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "26673"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "38392"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 258fd7af89efd701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows\AllowInPrivate	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "22"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.youtube.com	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify.	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = dd1ea0ad89efd701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.fda.gov	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "26863"	MicrosoftEdgeCP.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

AcroRd32.exe

pid	process
3056	AcroRd32.exe
3056	AcroRd32.exe
3056	AcroRd32.exe
3056	AcroRd32.exe
3056	AcroRd32.exe
3056	AcroRd32.exe
3056	AcroRd32.exe
3056	AcroRd32.exe
3056	AcroRd32.exe
3056	AcroRd32.exe
3056	AcroRd32.exe
3056	AcroRd32.exe
3056	AcroRd32.exe
3056	AcroRd32.exe
3056	AcroRd32.exe
3056	AcroRd32.exe
3056	AcroRd32.exe
3056	AcroRd32.exe

Suspicious behavior: MapViewOfSection 12 IoCs

Processes:

MicrosoftEdgeCP.exe

pid	process
1184	MicrosoftEdgeCP.exe
1184	MicrosoftEdgeCP.exe
1184	MicrosoftEdgeCP.exe
1184	MicrosoftEdgeCP.exe
1184	MicrosoftEdgeCP.exe
1184	MicrosoftEdgeCP.exe
1184	MicrosoftEdgeCP.exe
1184	MicrosoftEdgeCP.exe
1184	MicrosoftEdgeCP.exe
1184	MicrosoftEdgeCP.exe
1184	MicrosoftEdgeCP.exe
1184	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	pid	process
Token: SeDebugPrivilege	3856	MicrosoftEdge.exe
Token: SeDebugPrivilege	3856	MicrosoftEdge.exe
Token: SeDebugPrivilege	3856	MicrosoftEdge.exe
Token: SeDebugPrivilege	3856	MicrosoftEdge.exe
Token: SeDebugPrivilege	3100	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3100	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3100	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3100	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4664	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4664	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3856	MicrosoftEdge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

3056 AcroRd32.exe

Suspicious use of SendNotifyMessage 14 IoCs

Processes:

AcroRd32.exe

pid	process
3056	AcroRd32.exe
3056	AcroRd32.exe
3056	AcroRd32.exe
3056	AcroRd32.exe
3056	AcroRd32.exe
3056	AcroRd32.exe
3056	AcroRd32.exe
3056	AcroRd32.exe
3056	AcroRd32.exe
3056	AcroRd32.exe
3056	AcroRd32.exe
3056	AcroRd32.exe
3056	AcroRd32.exe
3056	AcroRd32.exe

Suspicious use of SetWindowsHookEx 9 IoCs

Processes:

AcroRd32.exeMicrosoftEdge.exeMicrosoftEdgeCP.exe

pid	process
3056	AcroRd32.exe
3056	AcroRd32.exe
3056	AcroRd32.exe
3056	AcroRd32.exe
3056	AcroRd32.exe
3056	AcroRd32.exe
3856	MicrosoftEdge.exe
1184	MicrosoftEdgeCP.exe
1184	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 3056 wrote to memory of 804	3056	AcroRd32.exe	RdrCEF.exe
PID 3056 wrote to memory of 804	3056	AcroRd32.exe	RdrCEF.exe
PID 3056 wrote to memory of 804	3056	AcroRd32.exe	RdrCEF.exe
PID 804 wrote to memory of 1464	804	RdrCEF.exe	RdrCEF.exe
PID 804 wrote to memory of 1464	804	RdrCEF.exe	RdrCEF.exe
PID 804 wrote to memory of 1464	804	RdrCEF.exe	RdrCEF.exe
PID 804 wrote to memory of 1464	804	RdrCEF.exe	RdrCEF.exe
PID 804 wrote to memory of 1464	804	RdrCEF.exe	RdrCEF.exe
PID 804 wrote to memory of 1464	804	RdrCEF.exe	RdrCEF.exe
PID 804 wrote to memory of 1464	804	RdrCEF.exe	RdrCEF.exe
PID 804 wrote to memory of 1464	804	RdrCEF.exe	RdrCEF.exe
PID 804 wrote to memory of 1464	804	RdrCEF.exe	RdrCEF.exe
PID 804 wrote to memory of 1464	804	RdrCEF.exe	RdrCEF.exe
PID 804 wrote to memory of 1464	804	RdrCEF.exe	RdrCEF.exe
PID 804 wrote to memory of 1464	804	RdrCEF.exe	RdrCEF.exe
PID 804 wrote to memory of 1464	804	RdrCEF.exe	RdrCEF.exe
PID 804 wrote to memory of 1464	804	RdrCEF.exe	RdrCEF.exe
PID 804 wrote to memory of 1464	804	RdrCEF.exe	RdrCEF.exe
PID 804 wrote to memory of 1464	804	RdrCEF.exe	RdrCEF.exe
PID 804 wrote to memory of 1464	804	RdrCEF.exe	RdrCEF.exe
PID 804 wrote to memory of 1464	804	RdrCEF.exe	RdrCEF.exe
PID 804 wrote to memory of 1464	804	RdrCEF.exe	RdrCEF.exe
PID 804 wrote to memory of 1464	804	RdrCEF.exe	RdrCEF.exe
PID 804 wrote to memory of 1464	804	RdrCEF.exe	RdrCEF.exe
PID 804 wrote to memory of 1464	804	RdrCEF.exe	RdrCEF.exe
PID 804 wrote to memory of 1464	804	RdrCEF.exe	RdrCEF.exe
PID 804 wrote to memory of 1464	804	RdrCEF.exe	RdrCEF.exe
PID 804 wrote to memory of 1464	804	RdrCEF.exe	RdrCEF.exe
PID 804 wrote to memory of 1464	804	RdrCEF.exe	RdrCEF.exe
PID 804 wrote to memory of 1464	804	RdrCEF.exe	RdrCEF.exe
PID 804 wrote to memory of 1464	804	RdrCEF.exe	RdrCEF.exe
PID 804 wrote to memory of 1464	804	RdrCEF.exe	RdrCEF.exe
PID 804 wrote to memory of 1464	804	RdrCEF.exe	RdrCEF.exe
PID 804 wrote to memory of 1464	804	RdrCEF.exe	RdrCEF.exe
PID 804 wrote to memory of 1464	804	RdrCEF.exe	RdrCEF.exe
PID 804 wrote to memory of 1464	804	RdrCEF.exe	RdrCEF.exe
PID 804 wrote to memory of 1464	804	RdrCEF.exe	RdrCEF.exe
PID 804 wrote to memory of 1464	804	RdrCEF.exe	RdrCEF.exe
PID 804 wrote to memory of 1464	804	RdrCEF.exe	RdrCEF.exe
PID 804 wrote to memory of 1464	804	RdrCEF.exe	RdrCEF.exe
PID 804 wrote to memory of 1464	804	RdrCEF.exe	RdrCEF.exe
PID 804 wrote to memory of 1464	804	RdrCEF.exe	RdrCEF.exe
PID 804 wrote to memory of 1464	804	RdrCEF.exe	RdrCEF.exe
PID 804 wrote to memory of 1464	804	RdrCEF.exe	RdrCEF.exe
PID 804 wrote to memory of 772	804	RdrCEF.exe	RdrCEF.exe
PID 804 wrote to memory of 772	804	RdrCEF.exe	RdrCEF.exe
PID 804 wrote to memory of 772	804	RdrCEF.exe	RdrCEF.exe
PID 804 wrote to memory of 772	804	RdrCEF.exe	RdrCEF.exe
PID 804 wrote to memory of 772	804	RdrCEF.exe	RdrCEF.exe
PID 804 wrote to memory of 772	804	RdrCEF.exe	RdrCEF.exe
PID 804 wrote to memory of 772	804	RdrCEF.exe	RdrCEF.exe
PID 804 wrote to memory of 772	804	RdrCEF.exe	RdrCEF.exe
PID 804 wrote to memory of 772	804	RdrCEF.exe	RdrCEF.exe
PID 804 wrote to memory of 772	804	RdrCEF.exe	RdrCEF.exe
PID 804 wrote to memory of 772	804	RdrCEF.exe	RdrCEF.exe
PID 804 wrote to memory of 772	804	RdrCEF.exe	RdrCEF.exe
PID 804 wrote to memory of 772	804	RdrCEF.exe	RdrCEF.exe
PID 804 wrote to memory of 772	804	RdrCEF.exe	RdrCEF.exe
PID 804 wrote to memory of 772	804	RdrCEF.exe	RdrCEF.exe
PID 804 wrote to memory of 772	804	RdrCEF.exe	RdrCEF.exe
PID 804 wrote to memory of 772	804	RdrCEF.exe	RdrCEF.exe
PID 804 wrote to memory of 772	804	RdrCEF.exe	RdrCEF.exe
PID 804 wrote to memory of 772	804	RdrCEF.exe	RdrCEF.exe
PID 804 wrote to memory of 772	804	RdrCEF.exe	RdrCEF.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\COVID-19.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3056

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
- Suspicious use of WriteProcessMemory
PID:804

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=58D0671EAE397B7B528605D1C322A4DB --mojo-platform-channel-handle=1636 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:1464

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=DB07C012EEB5F6CC8B03D15B49B7EA40 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=DB07C012EEB5F6CC8B03D15B49B7EA40 --renderer-client-id=2 --mojo-platform-channel-handle=1648 --allow-no-sandbox-job /prefetch:1
3⤵
PID:772

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=729DC0A8CDDD2371D5B6DC8A683FD91C --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=729DC0A8CDDD2371D5B6DC8A683FD91C --renderer-client-id=4 --mojo-platform-channel-handle=2088 --allow-no-sandbox-job /prefetch:1
3⤵
PID:1704

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A8853B2E53FF34ECFB1E62BDA1DF4644 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:3180

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3E30257D9274BC55D120C80625A6D451 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:2408

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=31A755341BE49C8E691373039E879051 --mojo-platform-channel-handle=1700 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:1624

C:\Windows\SysWOW64\LaunchWinApp.exe
"C:\Windows\system32\LaunchWinApp.exe" "https://www.opentext.com/about/corporate/opentext-supplier-information"
2⤵
PID:2108

C:\Windows\SysWOW64\LaunchWinApp.exe
"C:\Windows\system32\LaunchWinApp.exe" "https://www.who.int/emergencies/diseases/novel-coronavirus-2019/covid-19-vaccines/advice"
2⤵
PID:3996

C:\Windows\SysWOW64\LaunchWinApp.exe
"C:\Windows\system32\LaunchWinApp.exe" "https://www.fda.gov/emergency-preparedness-and-response/coronavirus-disease-2019-covid-19/covid-19-vaccines"
2⤵
PID:4764

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3856

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:2612

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:1184

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3100

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4012

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4664

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4816

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4552

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\MCS38BLT\www-embed-player[1].js
MD5
c8c5cb30f230cb168fb76b01eac0076d

SHA1
1d2ac5f8a1ef5764a1d6ab3e684b71b740936c59

SHA256
b5498bc67ac496a3fc5af517d67021c41a5c96115e91bf953fc4d3e754b41ba7

SHA512
59fd29e3ef891f469dae00c4418eb4f2830de6036a0e37ef80c94da00b2a43deab69244f6b572c6c85660eb7f0f590d4f66ac4085a4ce453e020f8c2e937385e

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\MCS38BLT\www-player[1].css
MD5
1a56bde26030e2b772908573b62b0f7d

SHA1
3c0ae3bea8f8ceb12495190f4003fbbc6cc71d92

SHA256
a6ec215ae1f79058f76e3ac67a8637b37baadf10dabcd5450b0cc8d0fa97934a

SHA512
b68d7bbc94d69c0ac1b099364f39ba23ffe259806922c4d7c878e3f5d4f8f199e5413a741c157674eb227bda1eddf9dcdcc56c4e28c9dabd3f2d07102f7211c7

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\NKBXYC5S\ad_status[1].js
MD5
1fa71744db23d0f8df9cce6719defcb7

SHA1
e4be9b7136697942a036f97cf26ebaf703ad2067

SHA256
eed0dc1fdb5d97ed188ae16fd5e1024a5bb744af47340346be2146300a6c54b9

SHA512
17fa262901b608368eb4b70910da67e1f11b9cfb2c9dc81844f55bee1db3ec11f704d81ab20f2dda973378f9c0df56eaad8111f34b92e4161a4d194ba902f82f

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\NKBXYC5S\analytics[1].js
MD5
d40531c5e99a6f84e42535859476fe35

SHA1
a901817d77b2fe5259c298c91bc65c54d7f8a1a9

SHA256
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

SHA512
0a0272b56df74d6cad69f3c56392e0eefae0516839bc487c1dc9f7bba922c9e29f942e95bd280b14c2f21f1f264392b68b47fe379eec7375ddad3c107fcf9afb

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\V511LN01\KFOmCnqEu92Fr1Mu4mxK[1].woff2
MD5
5d4aeb4e5f5ef754e307d7ffaef688bd

SHA1
06db651cdf354c64a7383ea9c77024ef4fb4cef8

SHA256
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

SHA512
7eb7c301df79d35a6a521fae9d3dccc0a695d3480b4d34c7d262dd0c67abec8437ed40e2920625e98aaeafba1d908dec69c3b07494ec7c29307de49e91c2ef48

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\V511LN01\base[1].js
MD5
3d4785dfaf99df060865b17e9bc8822e

SHA1
ae7ce81f6ab5994d86a0082581cb48004f5e9fb1

SHA256
377166a6e88578dd360e11ed2f62c5f2b637475bb2de3d8049e43eaf64e7b6b5

SHA512
9d3155f5abc128d3a8d2e5b1715773cf966eb7edb84ab298130c960f60b57a033777cdab495555f9465728f681e4011e8e4027c54ac9102b9a81839d83fd578f

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\V511LN01\fetch-polyfill[1].js
MD5
04e3cc8a9641b3f9f9c9370f4e9b5bdd

SHA1
9602a891f583094bb04fd407b253abcaffb8c8d0

SHA256
de6c4ffa2bd9fd283610e28d0db2ec48607aab39d213a51aef248673a0a7e980

SHA512
58942bcc0f39d620a475b65c1aeb4f18872f68f22c89dec076906a0db8bc2b7cca9357710a7824a0fa7404ff73f41013aeca34609caacd2187414f7bd0d490d6

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\16Q9ILP4.cookie
MD5
77b4b8e039b214f65eabbb096a520275

SHA1
57f984dc31525d8da25f93b09bd51b5f8166f2da

SHA256
ad1f3d5ed26825ba1f89549d1a2812386cbb96074fc267708b8eb8a20a74b3ba

SHA512
f7f29e19737bc3e57142a0365453be61ebf84c40165f69734e212fdb02fa73faab33472c3aed4106eed4353069fa240d6bd91070a8a794ecced1b0263d033d35

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\322USF9R.cookie
MD5
0bf42ad6e121e9ddb09657bc1c1e1b8c

SHA1
4f9b7dfa9a878cced4ef5292d7e0944f906ae74d

SHA256
e5eb13358b98df878a96752ba2eb403206467b20c1d5c99d3187a631783caf91

SHA512
f201c6d2cf1bfbc67da7c62b60469f57cf33ebc063d2780d4166d22676becda244c1ecfc8bcaffb928dc83165854c4187776c5448bf599b1078fc181729eb872

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\BXMVCO59.cookie
MD5
aa61a694fbd204676d9e3dec2abbd247

SHA1
38549f632225963d423c846d3a5fd2de87a0ea90

SHA256
112670000b666f3dc942d3fa9d2372bd94d4f23031ac77a4ebf25c0d10941f25

SHA512
21a238ab50d0b49536d64247f3413703591734120945c513044b58bbad86fc691f6e49f13e01bc5a882f41ae89ab580c5fa11de681c217c45bb8d204b609887b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\I73SQMFR.cookie
MD5
1b0e33e5c823a9253e26ac598aa9c12c

SHA1
494693486b71320c0bb1bf1ac857151ad0773069

SHA256
90f147351e8fc168cb76d0f7c65f0f1ffd1138cfd3e27af4cba701e8c5480c83

SHA512
e95cef4d7f047bd1495034843bfad9f3eeb3f9273605e4984e40c14263f170ffb01692585b5f00df0bb759f3c7e21fa493e3feb29e947448235d54a5341820e1

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\P087B0LW.cookie
MD5
a87e463bca79527f2a1a4f15d591050b

SHA1
121a9079e6dbe593f4419e7a7a8c91b2430aa62e

SHA256
2c28769d564dc979dc84135942c7969aa666dc333d2108b29280a6d54a4136c7

SHA512
f558340a4d09e90f5ac500228812bb528e34b48e4809674ba4c245694fe01fb069d3166f9791c4d032bfdfeb9100d7b682f5fa37b5f48fe35dc1ada6324edb40

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\P429V1XP.cookie
MD5
5d590e97373388495911fe2304c9ba22

SHA1
006b6c312decf53c39e7463c678795aceaab1a92

SHA256
6fcc72147a257dfc004262870160ad92716105bab1210db66239ff40fd530945

SHA512
5d77a468b38f2a37888384ae3434ec312934269dfe53826799d2e3dfb2c263dc66d2dc1321b54f6e8a13fc76c94d3233c58b21ad6b66a361b2a4101263b61c7c

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\ZILL9F1V.cookie
MD5
99461ecb55044ace0ea044662069b426

SHA1
ac1db93a1454088e0d4ff01d98b6697abbfef1ed

SHA256
b1dfebcaedd5f28cb020ec6be8bcdd7f5bcf6c08716acad5c05cfa2433f4a80f

SHA512
1a0d2944cf70f5bb9107cd29c669a20518bc19c37ddccd8013f3dd613acee531b8d6c86c528b9d33b0685dd196547c849e6233d9bd9177bb765c8d6341ef06a2

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\ZJRR9RLI\www.youtube[1].xml
MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\ZJRR9RLI\www.youtube[1].xml
MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\ZJRR9RLI\www.youtube[1].xml
MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\ZJRR9RLI\www.youtube[1].xml
MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\ZJRR9RLI\www.youtube[1].xml
MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\ZJRR9RLI\www.youtube[1].xml
MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\ZJRR9RLI\www.youtube[1].xml
MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\ZJRR9RLI\www.youtube[1].xml
MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
MD5
93a208bfe62da59e0298aecc96273d71

SHA1
15ace83530e325b2cab46d3e7354afbf9bd10314

SHA256
f05291287fc6c69229373f6f6f4473f4836e153006c0c3b1f101a0e7e4fd01f1

SHA512
62285e62da87c5553d7a652a45a89de2540047201eaf66c49eb7af78448aa9fdb3ef7e9b6c03c4e57eb074f4493a2c6423663bacc7d79bc7fae2734edd394218

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_8765BBA90BB648A0F9D8A21C36EE4B24
MD5
514e6190cd7fe90db1f17b8a50045c10

SHA1
9902a32c036c09809463d5051fa356880d2a8abc

SHA256
398108f5d206a2a345ca63ecf3daa6c6296149fd91dfb440240871e0e321ff3e

SHA512
a49eeaff9c08c806803392ef4675c96e2f8b2a104c0ea7ffb3893aef6328c154e725bc20e71935d0efbfdaecc6a3fef493dea172946dffa48e988db002054255

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\6A2279C2CA42EBEE26F14589F0736E50
MD5
8b153254225cf81983baa0400492b53e

SHA1
d2c94319c1a6d580325de5bb9921ef6ae85f0b06

SHA256
a3eb96967c5f501b5e14cf4e0a2bb4b9dfa8933352c973a1eae89c321804bc25

SHA512
8a20f17ddfc5de2aa2c535edecb63e4b6c44c94ab29032f5123cac42e8715e261bf259ff4a801ef65c2b0788bb8df25bbad9cc70c8c527911d6010e7f6e439aa

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
MD5
af9b8d8b635e625a54c3c7bd6dc19bdb

SHA1
0582fc44b6b6eafbb6dbca6c99a1c0ce4a070c28

SHA256
340773ea659b1b6e2c4091002f7f3e32636d4266079de1029106dfd3db9e787e

SHA512
43246082f415124f40192ce8f10b3edceba755771745fc87a4f83f2b7b7fd005764ca82dbdd6b89350cbdf9e35858cda666c7d4bd1169d0d0e32bcbe48ec8fab

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_AD319D6DA1A11BC83AC8B4E4D3638231
MD5
4cf1e57a0368aaeb1202d09be27c7690

SHA1
30a68ab2a8be2351dbb12dd96857c34763ccf0c7

SHA256
de7178cc231d98e13a12326a0992fe4c5f60e4ee326d0c788dc52700ce406837

SHA512
ad5a19c30698399cefe0169f32cd2551f7ba68d08d3e8a94fa4964e80a4734f1272d30b1afd14c08771b8c0764046b352a663d7932df80111430eea0d2132555

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6
MD5
3293fb5ae0da769d437f7c603f9888f5

SHA1
159551d73be034020300c378b28bd387cff84f93

SHA256
f69f5b2a6a364b26fe1f35a14cf7bfdadc371fa49ffb9a32453aaa85feaa28c1

SHA512
c521c538c5c4f34ae6421412d0a39aae3e7034a3f626c88c30711d4d64610a5c03a34598e3499f4b986bfbf3de15ea91f19a3560093308b7883198a3ccce2f43

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_93E4B2BA79A897B3100CCB27F2D3BF4F
MD5
01b163e90b97cfe8ca3c4b4900fe04be

SHA1
305d1f1ff9e4444d68586368c5047c557554d89d

SHA256
cfbe4fff0e79b5e05fe33f85c40513849fcedc44122925992a80a5b753c7216c

SHA512
32fbd95d73081f3e93aa0bdff7fe8e788f26688083ef496be1de8a96441ca9f13c83d033f5018f1ddd210b23f5fe2b3240a4169fd19eca1d1dea5726f0986ad1

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\9FF67FB3141440EED32363089565AE60_6A39BD4E62FE398368007E68FA2778EF
MD5
371bd3a63ccbb1f6e4bbcf23b020e41a

SHA1
3e5beb17e556732882b981ce6bd8f55b23eda009

SHA256
f30888ae0ce99a8c351990eb5109ca70962d9fe48e20e353a8d64980338057d3

SHA512
1b85f9b71da305f29c941a99213af417eb9504051246e12a308678a2f08d3dc9941318799f486a131c7199018ab04e6913c96c73534ddc616f1486859fb502bc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
MD5
ea3b10f28befad195a56c7032dbb4fe1

SHA1
fef15e7f5a5cc862e5d7ecd1551e29cd9626b5ed

SHA256
6d829e4fec85c2c7ca99af4230c0efa7c127ec5f3d14836b071ed08f0849c4cb

SHA512
f2737a1833c2fa77279da91f86d09981992f23c390d8f3d4b35a996b4a95c90f8a1b1a3d26248be761362250e3c9d2125a0e716f2ed17784af9ced1d0655bf58

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62
MD5
a8f641ca39a3f98226f9bbe822458f48

SHA1
04acf641499c0540d7dc0d1da1bc060670cd6125

SHA256
6868580336870bb3093698771d2832c2ee405e875a3f66bdb247f52698d95078

SHA512
5e4b5f6355f2201df3101ffae6e6ec3a26033845dad1ababc8c0946840575785e08279adb0763ae6f3d0656bbd972df3f9b6a97593fc82531f804da56514be98

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62
MD5
a8f641ca39a3f98226f9bbe822458f48

SHA1
04acf641499c0540d7dc0d1da1bc060670cd6125

SHA256
6868580336870bb3093698771d2832c2ee405e875a3f66bdb247f52698d95078

SHA512
5e4b5f6355f2201df3101ffae6e6ec3a26033845dad1ababc8c0946840575785e08279adb0763ae6f3d0656bbd972df3f9b6a97593fc82531f804da56514be98

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
MD5
a7b838370b4746f8adc72ae16d4dc227

SHA1
6175c5b1b3c22c56def908f116aa8c1a1a1ac927

SHA256
ed15f794e1543eaaf51ac6a61493b0c1062e32c5207f32f0f39880e4542eb1dc

SHA512
42eeb3255e85477240dbc2d9433ced6b0456a77f728f5cf0d1c19bdfad2407ffb9a793057d8a768bc34d3ce9a21a808870ba93e87033279eeae1eab45bc75e15

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
MD5
64e9b8bb98e2303717538ce259bec57d

SHA1
2b07bf8e0d831da42760c54feff484635009c172

SHA256
76bd459ec8e467efc3e3fb94cb21b9c77a2aa73c9d4c0f3faf823677be756331

SHA512
8980af4a87a009f1ae165182d1edd4ccbd12b40a5890de5dbaea4dbf3aeb86edffd58b088b1e35e12d6b1197cc0db658a9392283583b3cb24a516ebc1f736c56

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_2ECA9760FAC6508272ACB49C09C6E726
MD5
3aae5a70eeca85364a9225d8b5d1ba88

SHA1
6785fa30d763acf22cde346ace46a8e0b90902c7

SHA256
1bd1875a773954f138636cd3188746f2250b8621b1cd521688afc55038211204

SHA512
aaf8c7d9bae9e746f57fddb0ff10b3a1d83bcc00b36f7f0f4ca6e75767db2c9fa5833af56e203ae0cbb9997007de156bda51411f5fdb09805ce5683099c5f3b4

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_3B8C55AA97E794FD3C08930867EF4A80
MD5
f475374198813783b2e9607037bf4aa8

SHA1
617ade4e778f40ae8721ba62ff35937324c3c27f

SHA256
1c3a092be2ea497b1ac0b5e6181cc2f8bba05b62363504246380b0c71546d12e

SHA512
659c535cd743269d2e5a9ca4f26fa6e5b40ad1a3695e17186b054df2844a20c7d1368c83254f034a5ad16d8011d32b7e87eb78e37daabd6369f13d09c7d9cb0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_236E243F97CD352248042AF77144B4DB
MD5
4d9bc358616fc165187e747869ab2353

SHA1
6282b0eca2484b6a59012897d7ae3ac2e8d4a3aa

SHA256
7c404dcd4aba288acb1faf0973a68957df6b54d1f973c8ee2966af00bb0000d8

SHA512
fb58cf3aa2680057e45d7833da938036d526e401f53781ccd6665679505e3dcdf7550ad2d5c34c155a7c7968145597d1130ca45c68073ec32d3bbcc008d72a71

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_372439F36B9916D184DAE33F964401E9
MD5
6a337ce1d1add4cdfb16aee5328273d8

SHA1
3a9cdb048b5a39c5180217dd7aed35f324c8d560

SHA256
d1010eb15dd3ad177f7fa85096ec7e306e14f45104c15c7e512e667180efd82d

SHA512
4383a252e7a7330e909960d42513c9561d83694ce6135b5de34ce042c89dd6b24c3c3ffca47b07ed6dcf31db00505751cbcb1bde1d157ae319f1ee3e935d086e

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_489990FE5E216C6B1777255755C66881
MD5
6eb064c1e5d5a3e52c499eb494f9a26b

SHA1
c824b7fc2b78f7ea1255d8e62562aea1a22df8b2

SHA256
154dca254d671dfee45c0dfacbca2e0a8bf17bdfaf11e6a0f32f2054e9262e87

SHA512
8daddb7c7e5b19634d573548dbd06a344dca9c4615b570ecef7714f3c22fdd31c0b6d154d521f733bb2f90ebe1f514b0a9d3dde35c28912c141a97452984ba96

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_77E1B7F71AB9C3E24500EA0757E68446
MD5
12df09b1add304d748662b95cb102969

SHA1
063bfd3f8d50ecfa6796f3f1c1579731b336ce30

SHA256
0343b8a34dce8d24c5afd323ecb8ad5e5c84568347d7a109f3f58b519580a33f

SHA512
c3b034b6d78cbb231f0d81876727f59e3d9c750eae29b34df57b2dec8e567ce69f8ea92daa1c0510cd6e981fa819a6b60e0af2a0115dace006d32c7c289466ff

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
MD5
6430da085a2528d22bfaed021d77cd71

SHA1
c1bec33cc4bcd4f47fb97c9868f4caaa2260e322

SHA256
d319ac8dd21a256baccfa743726c7bc06d0848a8036d523ca8774a8c49a54f4b

SHA512
c8d3cd40926a6dd9ba7ef2100776acacfaced2f2d87116c6f16b9f9b7e1943dfa4ccbe34c6ff1f4fb6df4b63ed2ed434dabb85c83e0713d77bab8a78c9d1f6db

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_8765BBA90BB648A0F9D8A21C36EE4B24
MD5
7e725ff47e43f31d9bdbe55017948ab2

SHA1
7a1e248b9625b08127dad01bb67e7630cf27dfff

SHA256
73179a0f420d4945dd1518c137e12d2f666c99bc6d69a4f52424532f2877afca

SHA512
9d943af42e2558632d0d4f07fc7827bdac3eadb25856e56a7026a17250405c119bd24b4d788597ae8279d61dc20f9a1986995513e0c9029a7ac6f4e21387ffc0

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\6A2279C2CA42EBEE26F14589F0736E50
MD5
4817c6647ef51d5e80ea7f5a46b2fb37

SHA1
b8041f1971ed17a66450aa86af97442dc8e14aec

SHA256
2bba1d05dd3ac71cb56eeee332a71b55db8509bee622ccd1eb3454c7c502e0fa

SHA512
186678fa16a6b8d9a00b080ce83e07d0084c5c130055b248949b3632b0db9bdf748c32f20d95e7cbbdda1fe353b124e0c337f4f1275745c9a616f1c9a99be850

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\6A2279C2CA42EBEE26F14589F0736E50
MD5
d10f2ff3be28838b00d43eb58297f3cd

SHA1
3aafbbb33a8edd282eba81b735a89509011c80df

SHA256
903c0f88cf671cadefabe4255a9c4fac6dea69b1a751c6cc3304c3773fadc875

SHA512
07ddd4b71616ebf0f0ce5724de24cfe796b8eb771cebb4094f4aefe9a08f203e69a1f433ed42c71c7a3373862efe259f9de2e3d6bb1339b21ef0f849215eaded

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
MD5
254b59f7d2e3af693f31c2cbcc821524

SHA1
8594cf26a8b8ba5d91f75a770b20a585730ded17

SHA256
a7d9ee6378a408da6d77ed80162eafa34ddcec3eeddc730df73215e59b809232

SHA512
60df568702f97640d9504a1df12c858fcfff03eed08ad1d13bcd8b4921f39e94451e27fe68cd82b16a69881ff3cadc2b8592acca28446d384336f4f7019c3d00

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_AD319D6DA1A11BC83AC8B4E4D3638231
MD5
43992e951b29afbb46ab57e71a01f9df

SHA1
784a4987971daee37a3f43f9a052675654469128

SHA256
abe059b6c638e82ab47754b9ae68d175011a50f06a12f239f5fb1679f2f15d84

SHA512
64a2edc9fd6e280557ab7602a2767e36eca3c365e94b11c83ef76f099533d5811d44c043c81069a347a44675224f23b19edb5078e31d12544a1ff0f4a6b5300b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_A30EA9B4E1BC5DBF09A8EF399E086D27
MD5
9b2dfc61bfa80a1716f96b55393ff3ea

SHA1
3157957870b1962ad4b8757e407e405f1eed7299

SHA256
1a2d8b3499d9515807c2005490310e14fc68faed7f8817686566e7068421ee52

SHA512
d1d623bb5d42893f05846878894f642f80722d0964d61566eff12e010f23c67906b963529c82c080f4509944b7498a522a024732ef03df7d8c6c11c6307d02dc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6
MD5
1a483619d106c7c0eb79f898b20597b4

SHA1
80dfcaa7997970baa2f5ad3d23d3a3278b4d5a76

SHA256
afd34371cb7a759b155a65158a749e39ac4a2c573b76bfac39a1e0f43016abdf

SHA512
bbe44a667c21d850b1c398723e40f793cf91f43530de51c0b1777b8c504767e95650c128f5428de4b2be3133b60d210b039eb0fefdfa335e047a1f47e4fa4b3c

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_93E4B2BA79A897B3100CCB27F2D3BF4F
MD5
6cdeb269e04c783446dc618e072510d7

SHA1
9575694f30d2f0dbb95e6b8e37e31cc9d34a0320

SHA256
23a7ec5885507d57a50a17b3662fe8c21d235a4e4ee43ed217a18bd3b301fe4f

SHA512
b4a4848d2d96a5678014a6c8fa0cb16b9bcc494c356dff193a34400746122bccf2426c8269dd33ef0c1854e4ca0ef26b4c05a8f5c0e5e92eeb30cf046cccf2dc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_93E4B2BA79A897B3100CCB27F2D3BF4F
MD5
ce29cc21ba5421aa60f25653e227a4fc

SHA1
9ed4158da2c8fd594d8b3cf2efd8fd3ebc24d939

SHA256
15ba0a316595273e902bd7d6043d4c4574d6a021dbcbf4d88f4ed3881aa441eb

SHA512
7d9c1827fea955189df6b8daa300d268a984f5014c6bba107c87af4ef8a88d7c65d50013c45b211b3dfc223d62b64489e4f9f84a6020e84987cd4641c9353ead

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\9FF67FB3141440EED32363089565AE60_6A39BD4E62FE398368007E68FA2778EF
MD5
a9f7665589061f0665f2a5e350ad21c8

SHA1
6e4516bf7375d74fa30c778379e1cc0b8fea4a38

SHA256
3bd2f86c5071c063dbcc05174bde714fb6ad2329708dd797604e57e921955367

SHA512
00bb761dfab612b952c85618df8523309a51c8fcc0a8b18c8d5459918a5e1333d40cb05e3af2cbf82d8d0eba321745a4519d8a6d19ddb23054976164a9d01a66

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
MD5
d79f81630e1075fcd72ddd3632a0fc94

SHA1
1365f1d34676156f275b25e95a249a3088fefe13

SHA256
5cffe0b0a145aa6c9c6cbca7ceb59898dc13b665e704f9d35aa86957029801e5

SHA512
d800b3748e333ce5bc2b166c262df024bcc96fe7705a6615f48d72d07a6011779b866c2b19bd7ad280ed7dc5a28f841f7041c601a68fe4c2444cfac2fb6280d3

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62
MD5
9625aab1637087e9451a6e89fa59f56c

SHA1
29d34c267b2ee8c2c59dccebffb027618861664d

SHA256
b629626378e7756701d74438217c171932d1246267650bbb41cd682fe66cc629

SHA512
9d616a277481fe7441c97b427160c1440e7675f0b687835887c32e94608873e2a2b76721d7e70994a9c687af33a8aafc2d58472b60c2a607e0ba173be4504555

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62
MD5
1ab09bb211300a2bd3c384af79480de3

SHA1
96a141a12e5163f0f9de9d93d325cb96e429a051

SHA256
d72c524a34a2bb88cd949c11638149d134cc7d417c82684b564887477ce6d8b4

SHA512
01d485ff4a250e625381f92e10fd79a1dd618330ecc9e0f1b886cc8054753c438f0382fa7f195a5e38a82cdac6cc7f0a5d643dd63f47230f7f6a94d2a7f1afec

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
MD5
bc8b7a108cd82e3ccb1987b036b3d15f

SHA1
d8b752886873fde303e6114290f71fcd200a2a21

SHA256
355f151453a0c2457f6776bbee5023ed82dd91f02155ccba55be3372a9ceb8c8

SHA512
0b46743f7e80903fdf393ee3d6bd75eee75af7820a7fb746290d12ef962a83513fcd1df78fb734aad801ffc63d49602b4fc27c79569b0e7574226c2a7ae6a6d6

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
MD5
60a566e6d908a367f64a939d70b8ee62

SHA1
8830f13d81a9cf50b969560e6be0b3a7e7f1490f

SHA256
0124833322c341414973a458c8ab9c206f400e4a490d29eb6da73b23d6ec82f2

SHA512
222ec4041685f59afa033a9a86a40dfc3a06b70ecafd41c1816fe849f89e896744a24b026bff1f74af719f1f88ca76f7a2166592a878d3dd730b9a818308640d

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_2ECA9760FAC6508272ACB49C09C6E726
MD5
e07d3e05769e6a0311d3d01da728cf66

SHA1
5b5f5f9a1b11ead97b9ecd45159aba8ef3b20b61

SHA256
78539abdbcf5920fcf04cef0883d60452bd3a1aef6aea1e8f827dddeedff04f9

SHA512
8d4dc7c4200283683549f251174e4d4a190c79c89a6b3310a52fcbcdeb3bfb7d795cd4937c82c480187ab1390352aa9ff1ade6eb0cfd7a523897e3eed7d99cdd

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_3B8C55AA97E794FD3C08930867EF4A80
MD5
e0e402f45a6ba643658faa033fa6be7d

SHA1
8d2000e58a50b9455ec4f9e824964e8e528823b5

SHA256
d6aedbc7c54af023748308853091b66b5ecbf6e598193177c565d1458d41ef65

SHA512
7f75a1a294b17479937b46c751d075c0b5032e05a643a1c4d76883978c97c66b6364af933577c8e515330390ceefcd9f2ccd6ff0005e3e6bc6b6a66577c0785c

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_236E243F97CD352248042AF77144B4DB
MD5
26d6b8021f7eb2caa9d6ee36b35c29e4

SHA1
67103ce20694ca38c1ac6e52418ec0e5b823bfa0

SHA256
7bd850f912c5a80c41abd9af1740eebbc24a4d0d05b5866922887a424cea5450

SHA512
2d26a8ddee7d1011f5527162583ec38d527daa6099a097479468306d399e56c2f51c9d1559112d0aebc0e2f0a73c892c49e2b474aa588eb24036971b4ea91b3f

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_372439F36B9916D184DAE33F964401E9
MD5
88f18472a0636b804b3aa68ea6f3d48e

SHA1
6ff9bb75a771b46ca0c084b41e27ed33dd7bd8fa

SHA256
772cf78e68fbd6aff4a52b56091f314b114f3bb654f2b27bbe12746af1ae631b

SHA512
c18796b935e18b62357875b9a3f7a54e4d4a12709b9ff8b57275e6c119abd4264b1a521688e1c30b1a3441389283511445650050a6aca18a1c4e38251d3211af

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_489990FE5E216C6B1777255755C66881
MD5
ce81c96cbee0b026a42e2244ae028c9d

SHA1
14486ae7f430717db87261e9072d3c7fb22798d5

SHA256
0a392d2d06cc4a4e7ba5ad19a1ea90d311b5c93cf4ad708c7d79a10834f70acc

SHA512
afca5a5636d574cb86e1fd6ec74328e6c0ca24f059e2834ff0d3f3bbc168c7e52084cac68dc68fa0afb9202c838f997dba0d1345646710212eb6a5c16b11c0a2

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_77E1B7F71AB9C3E24500EA0757E68446
MD5
793fab34c1d800e05e86cef0e7220dd3

SHA1
b6474bde1fd3ee8d147c543b0c56111aee489d74

SHA256
456f11e9925e224a3a7e87c103dca242a64b41ee91a796d91e43288429bbb224

SHA512
85b77e1cec1015e2aa149984887d328aa51f061ab6ad00f392e4d545115bed053a029cf74c1a9ed9f04798e748037b226d27bee96fc56ec0d6bf47a978dd559b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\Windows\3720402701\1659841449.pri
MD5
6dfa43a584ed243390dc943abac397c0

SHA1
665637e060c9da24288944b90b377a309da6d533

SHA256
4f31fe4baa7a557ed5fc2ccf57b2861946ecea6222200aca124796e251a524ad

SHA512
9561a2867cf1e73578d0206d4c73e576e2b8c7497ec1db8a69df6a35ca78e84bf01060089e45ec32e5afde6d3b1de26afcd0e411a25b615042ce5bdd575cb6b0

Download Submit
memory/772-124-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

Filesize
4KB

Download
memory/772-125-0x0000000000D70000-0x0000000000D71000-memory.dmp

Filesize
4KB

Download
memory/772-121-0x0000000000D56000-0x0000000000D57000-memory.dmp

Filesize
4KB

Download
memory/772-122-0x0000000000000000-mapping.dmp

Download
memory/772-119-0x0000000077002000-0x0000000077003000-memory.dmp

Filesize
4KB

Download
memory/804-115-0x0000000000000000-mapping.dmp

Download
memory/1464-120-0x0000000001000000-0x0000000001001000-memory.dmp

Filesize
4KB

Download
memory/1464-118-0x0000000000000000-mapping.dmp

Download
memory/1464-117-0x00000000011DB000-0x00000000011DC000-memory.dmp

Filesize
4KB

Download
memory/1464-116-0x0000000077002000-0x0000000077003000-memory.dmp

Filesize
4KB

Download
memory/1624-140-0x0000000077002000-0x0000000077003000-memory.dmp

Filesize
4KB

Download
memory/1624-142-0x0000000000000000-mapping.dmp

Download
memory/1624-141-0x0000000000BF1000-0x0000000000BF2000-memory.dmp

Filesize
4KB

Download
memory/1704-128-0x0000000000000000-mapping.dmp

Download
memory/1704-127-0x0000000000F10000-0x0000000000F11000-memory.dmp

Filesize
4KB

Download
memory/1704-126-0x0000000077002000-0x0000000077003000-memory.dmp

Filesize
4KB

Download
memory/2108-144-0x0000000000000000-mapping.dmp

Download
memory/2408-136-0x0000000077002000-0x0000000077003000-memory.dmp

Filesize
4KB

Download
memory/2408-137-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

Filesize
4KB

Download
memory/2408-138-0x0000000000000000-mapping.dmp

Download
memory/3180-132-0x0000000077002000-0x0000000077003000-memory.dmp

Filesize
4KB

Download
memory/3180-133-0x0000000000FA4000-0x0000000000FA5000-memory.dmp

Filesize
4KB

Download
memory/3180-134-0x0000000000000000-mapping.dmp

Download
memory/3996-145-0x0000000000000000-mapping.dmp

Download
memory/4764-181-0x0000000000000000-mapping.dmp

Download