18a29ebd902a52add72e3eecb6a234e221fb91b24ae776394703b2c138beacb1

Resubmissions

25/05/2023, 19:48

230525-yh3tkacg61 5

25/05/2023, 19:46

25/05/2023, 19:33

25/05/2023, 19:33

25/05/2023, 19:27

Analysis

max time kernel
150s
max time network
144s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
25/05/2023, 19:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

@lbzvm+s8460+397+6728+591+46 5+6684+ zbdovis+ 2839+8045.pdf
Size

33KB
MD5

d3945d4eab98cf2d48e34cff91a3c843
SHA1

a73d10b005208c06ab772c635d581473dcfeaf20
SHA256

18a29ebd902a52add72e3eecb6a234e221fb91b24ae776394703b2c138beacb1
SHA512

4006351b7b9df138115ed0f4e893cb025c492fcb2f9b6f221eb1ba741be89572cb0ccc4cb8edcd0b5bad93606dc0f53b50d858bb3e648516e85ca5f86c269608
SSDEEP

768:C4/gHYX/wnbFDyzeD1Wkzu30XkLGHj+4R0EzkavINL+xPt1xv:v0YX4nxD0eJXU6+4MqI1aZv

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 5 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = bef156ad528fd901	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 34ff74d6528fd901	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\ = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\LastClosedHeight = "648"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\Total\ = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\bing.com\NumberOfSubdomain = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com\ = "652"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\LastClosedWidth = "800"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 30e8b0db528fd901	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DOMStorage	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\ClearBrowsingHistoryOnStart = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B72164 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$blogger	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\EnableNegotiate = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "268435456"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\MigrationTime = 84a3779c5945d901	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\DetectPhoneNumberCompleted = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = 010000002dd27c803d1c0b1d8b3b39f196ec130e05b184e6c2cf9f9e822fb60674dc2bdf6e72e09db2dc72db0419c5825befc4ca5ac927e0cc26f6991c4b81f46f294db3caaa4490aad109d51e59e6bde0ce3bc2fc4ac68f6142db11e217d01e08637909a71c926c511c9198c69a8c992eabf02e39d554ea184383397b35b9b652aa93f3cd6781085cdb9f7daf7c4282b6a44d84a1081089e04844694a44614b3d1e7bf9b42bd322ea2f6832ac9fb1a408dba8603a850cd6ed738293f8e3896a26df2d38aa086419c1386598c8a32775a06e5f4c30eabdcc36e3530c5eb4db565b0da641b49e082f76172df065299f0f0b7fb14b98d8244538b839981b5600c572c848da6d8dde637ceae3564fcfd9cea22c7b3d31f010d73a12a0d6ec6836b30d3008807b7595d8add2079010361fe33d97000cc4d00945bb107ff20a8cd748e165abc402f629c931f04128ecfe39ff87defcb1721a097bc4d447a7616189c8f987067203b0140f1b6235d98ac7371115231e011c6cf31f3d7dd397c986f096e0b65a887e43563be949034d8c31510c8b849a4ee3678aae2e2bc2ef06cbd201f971576781058e1cd7a1	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames\	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 88bae5b3528fd901	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData\RulesFileNextUpdateDate = "391213431"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\Total = "604"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\AllComplete = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites\Order = 0c0000000a000000000000000c0000000100000000000000	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionI	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2448	AcroRd32.exe
2448	AcroRd32.exe
2448	AcroRd32.exe
2448	AcroRd32.exe
2448	AcroRd32.exe
2448	AcroRd32.exe
2448	AcroRd32.exe
2448	AcroRd32.exe
2448	AcroRd32.exe
2448	AcroRd32.exe
2448	AcroRd32.exe
2448	AcroRd32.exe
2448	AcroRd32.exe
2448	AcroRd32.exe
2448	AcroRd32.exe
2448	AcroRd32.exe
2448	AcroRd32.exe
2448	AcroRd32.exe
2448	AcroRd32.exe
2448	AcroRd32.exe

Suspicious behavior: MapViewOfSection 8 IoCs

pid	Process
312	MicrosoftEdgeCP.exe
312	MicrosoftEdgeCP.exe
312	MicrosoftEdgeCP.exe
312	MicrosoftEdgeCP.exe
4396	MicrosoftEdgeCP.exe
4396	MicrosoftEdgeCP.exe
4396	MicrosoftEdgeCP.exe
4396	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeDebugPrivilege	4132	MicrosoftEdge.exe
Token: SeDebugPrivilege	4132	MicrosoftEdge.exe
Token: SeDebugPrivilege	4132	MicrosoftEdge.exe
Token: SeDebugPrivilege	4132	MicrosoftEdge.exe
Token: SeDebugPrivilege	4480	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4480	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4480	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4480	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	4480	MicrosoftEdgeCP.exe
Token: SeCreatePagefilePrivilege	4480	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	4480	MicrosoftEdgeCP.exe
Token: SeCreatePagefilePrivilege	4480	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	4480	MicrosoftEdgeCP.exe
Token: SeCreatePagefilePrivilege	4480	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1432	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1432	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4132	MicrosoftEdge.exe
Token: SeShutdownPrivilege	5044	MicrosoftEdgeCP.exe
Token: SeCreatePagefilePrivilege	5044	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	5044	MicrosoftEdgeCP.exe
Token: SeCreatePagefilePrivilege	5044	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	5044	MicrosoftEdgeCP.exe
Token: SeCreatePagefilePrivilege	5044	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2084	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2084	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2084	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2084	MicrosoftEdgeCP.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2448	AcroRd32.exe

Suspicious use of SendNotifyMessage 9 IoCs

pid	Process
2448	AcroRd32.exe
2448	AcroRd32.exe
2448	AcroRd32.exe
2448	AcroRd32.exe
2448	AcroRd32.exe
2448	AcroRd32.exe
2448	AcroRd32.exe
2448	AcroRd32.exe
2448	AcroRd32.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
2448	AcroRd32.exe
2448	AcroRd32.exe
2448	AcroRd32.exe
2448	AcroRd32.exe
2448	AcroRd32.exe
2448	AcroRd32.exe
4132	MicrosoftEdge.exe
312	MicrosoftEdgeCP.exe
312	MicrosoftEdgeCP.exe
2176	MicrosoftEdge.exe
4396	MicrosoftEdgeCP.exe
4396	MicrosoftEdgeCP.exe
2084	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 4940	2448	AcroRd32.exe	66
PID 2448 wrote to memory of 4940	2448	AcroRd32.exe	66
PID 2448 wrote to memory of 4940	2448	AcroRd32.exe	66
PID 4940 wrote to memory of 3124	4940	RdrCEF.exe	67
PID 4940 wrote to memory of 3124	4940	RdrCEF.exe	67
PID 4940 wrote to memory of 3124	4940	RdrCEF.exe	67
PID 4940 wrote to memory of 3124	4940	RdrCEF.exe	67
PID 4940 wrote to memory of 3124	4940	RdrCEF.exe	67
PID 4940 wrote to memory of 3124	4940	RdrCEF.exe	67
PID 4940 wrote to memory of 3124	4940	RdrCEF.exe	67
PID 4940 wrote to memory of 3124	4940	RdrCEF.exe	67
PID 4940 wrote to memory of 3124	4940	RdrCEF.exe	67
PID 4940 wrote to memory of 3124	4940	RdrCEF.exe	67
PID 4940 wrote to memory of 3124	4940	RdrCEF.exe	67
PID 4940 wrote to memory of 3124	4940	RdrCEF.exe	67
PID 4940 wrote to memory of 3124	4940	RdrCEF.exe	67
PID 4940 wrote to memory of 3124	4940	RdrCEF.exe	67
PID 4940 wrote to memory of 3124	4940	RdrCEF.exe	67
PID 4940 wrote to memory of 3124	4940	RdrCEF.exe	67
PID 4940 wrote to memory of 3124	4940	RdrCEF.exe	67
PID 4940 wrote to memory of 3124	4940	RdrCEF.exe	67
PID 4940 wrote to memory of 3124	4940	RdrCEF.exe	67
PID 4940 wrote to memory of 3124	4940	RdrCEF.exe	67
PID 4940 wrote to memory of 3124	4940	RdrCEF.exe	67
PID 4940 wrote to memory of 3124	4940	RdrCEF.exe	67
PID 4940 wrote to memory of 3124	4940	RdrCEF.exe	67
PID 4940 wrote to memory of 3124	4940	RdrCEF.exe	67
PID 4940 wrote to memory of 3124	4940	RdrCEF.exe	67
PID 4940 wrote to memory of 3124	4940	RdrCEF.exe	67
PID 4940 wrote to memory of 3124	4940	RdrCEF.exe	67
PID 4940 wrote to memory of 3124	4940	RdrCEF.exe	67
PID 4940 wrote to memory of 3124	4940	RdrCEF.exe	67
PID 4940 wrote to memory of 3124	4940	RdrCEF.exe	67
PID 4940 wrote to memory of 3124	4940	RdrCEF.exe	67
PID 4940 wrote to memory of 3124	4940	RdrCEF.exe	67
PID 4940 wrote to memory of 3124	4940	RdrCEF.exe	67
PID 4940 wrote to memory of 3124	4940	RdrCEF.exe	67
PID 4940 wrote to memory of 3124	4940	RdrCEF.exe	67
PID 4940 wrote to memory of 3124	4940	RdrCEF.exe	67
PID 4940 wrote to memory of 3124	4940	RdrCEF.exe	67
PID 4940 wrote to memory of 3124	4940	RdrCEF.exe	67
PID 4940 wrote to memory of 3124	4940	RdrCEF.exe	67
PID 4940 wrote to memory of 3124	4940	RdrCEF.exe	67
PID 4940 wrote to memory of 3124	4940	RdrCEF.exe	67
PID 4940 wrote to memory of 2904	4940	RdrCEF.exe	68
PID 4940 wrote to memory of 2904	4940	RdrCEF.exe	68
PID 4940 wrote to memory of 2904	4940	RdrCEF.exe	68
PID 4940 wrote to memory of 2904	4940	RdrCEF.exe	68
PID 4940 wrote to memory of 2904	4940	RdrCEF.exe	68
PID 4940 wrote to memory of 2904	4940	RdrCEF.exe	68
PID 4940 wrote to memory of 2904	4940	RdrCEF.exe	68
PID 4940 wrote to memory of 2904	4940	RdrCEF.exe	68
PID 4940 wrote to memory of 2904	4940	RdrCEF.exe	68
PID 4940 wrote to memory of 2904	4940	RdrCEF.exe	68
PID 4940 wrote to memory of 2904	4940	RdrCEF.exe	68
PID 4940 wrote to memory of 2904	4940	RdrCEF.exe	68
PID 4940 wrote to memory of 2904	4940	RdrCEF.exe	68
PID 4940 wrote to memory of 2904	4940	RdrCEF.exe	68
PID 4940 wrote to memory of 2904	4940	RdrCEF.exe	68
PID 4940 wrote to memory of 2904	4940	RdrCEF.exe	68
PID 4940 wrote to memory of 2904	4940	RdrCEF.exe	68
PID 4940 wrote to memory of 2904	4940	RdrCEF.exe	68
PID 4940 wrote to memory of 2904	4940	RdrCEF.exe	68
PID 4940 wrote to memory of 2904	4940	RdrCEF.exe	68

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\@lbzvm+s8460+397+6728+591+46 5+6684+ zbdovis+ 2839+8045.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4940
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=1121F93BCD3FAC81B9AC4620F39ADB07 --mojo-platform-channel-handle=1628 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3124
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=68A049E27C5CF266A1ED191A6BD41E15 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=68A049E27C5CF266A1ED191A6BD41E15 --renderer-client-id=2 --mojo-platform-channel-handle=1664 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:2904
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=0637FCD9C78272CE0A429A836AE0CE01 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=0637FCD9C78272CE0A429A836AE0CE01 --renderer-client-id=4 --mojo-platform-channel-handle=2064 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:1476
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=034959297DC1E70E6EAA8AE95F3A5F68 --mojo-platform-channel-handle=2472 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3828
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7C0CB0C4EBB4047E9039098CF32BFB83 --mojo-platform-channel-handle=2568 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4840
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=8DB4A61076E0ADD50122792136EBD193 --mojo-platform-channel-handle=2604 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:768
- C:\Windows\SysWOW64\LaunchWinApp.exe
  "C:\Windows\system32\LaunchWinApp.exe" "https://www.google.com/url?q=https%3a%2f%2faction-get-new.fun%2falcQWH4Jx5%23ebytqxni&sa=D&sntz=1&usg=AOvVaw0kJ8n_mmxdc911W010X3-H"
  2⤵
  PID:4472
- C:\Windows\SysWOW64\LaunchWinApp.exe
  "C:\Windows\system32\LaunchWinApp.exe" "https://www.google.com/url?q=https%3a%2f%2faction-get-new.fun%2falcQWH4Jx5%23ebytqxni&sa=D&sntz=1&usg=AOvVaw0kJ8n_mmxdc911W010X3-H"
  2⤵
  PID:1392

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4132

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:5096

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:312

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4480

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1432

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:2200

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4168

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2176

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:4280

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:4396

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5044

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2084

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6CI3IN3W\edgecompatviewlist[1].xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\6W9DVHZ9\script[1].js

Filesize
266KB

MD5
2fceca9c9c3a844bebbd26dabfb3ab88

SHA1
8d701f2ba8caa71d80c86d91cfec71feddb519fe

SHA256
04d1d1916ce115057f37990dc90a883df8d6ad4a0164e4328e7e93b0b3779766

SHA512
736560fd820a67159e58c505da9f4d702bf68009af43f696852dad0a362e02adc9eddd60e9eabd16737dfd0b25994b2272a83c1cafc3ce39e1dcbeeccec66afa

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\6W9DVHZ9\style[1].css

Filesize
476KB

MD5
f9ef64283b5dcc83b5337d7869c86b96

SHA1
80375f6b9504014d7efc3aaa5b7cc9a931e65e99

SHA256
511c3a3fe26e62d2fe113f6314ae2193a3fe9d167cef3d30168cc0a556ce2100

SHA512
8df2922ddc9ea83a41c483655aa5bbc3824a1dcc9ba523bfbad0127acf377d56f2fa0fafd8f0746ab7ad2120c02d7fea5111b3b8fe39263fe31ca8fecac1a27e

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\U3CMTV34\js[1].js

Filesize
221KB

MD5
6a587173684b74bf5c9da42f2ebbd8cb

SHA1
3d50e5e3afcebe949c5790cde9d9d8c35c0a7491

SHA256
c21a014f70825477f8636f7dfecb72a2e95fc15400138da3a26a7f6ec6169f81

SHA512
8b05dc97665f8f005609268cc45af449c3cd3bb928eec03a980793711709e54f9c57a479da685c071346eb2b61bf471746c9dbb99b7bd50cb73a27c20b7775bc

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\VW4VS6OL\p[1].js

Filesize
375B

MD5
08d4f1f01af88a5f659d061ed01725a2

SHA1
8e7efa1c2a210d631724de9c6583d292b1eac3f5

SHA256
d1fc940d7d8316fa83e0614c91c9e8494a060954078101a7b11ad72e305b4b02

SHA512
450e82472f509104f5a88da5627ee20db28ee92fda125870a8daef9e66342e8d6bedade9c6baba855664d4723bb6cff8136c1d8e554608a0d2a90b5668d5057e

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!002\MicrosoftEdge\User\Default\DOMStore\ZQPRNHVE\www.bing[1].xml

Filesize
1KB

MD5
d17c4c8874bbd8715504a10da8b7fd62

SHA1
8e6a0f1b6915a7fb9d0030d9ac06695a9f290684

SHA256
d4ab229353e9033c42c1ceb19b54d0dc086ecc60cb28bb70f2fc3d0b9e3ecbe4

SHA512
fe44408aff1ab74b285c4ecf7103e206847f6ae99a81178e1f0e630c4e157efa5a2242289758802d50f5af870a5a5d0fa07d0acd29d58bf712b03574aba2e363

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\BY67WOT4\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\HFESDE7A\favicon[1].ico

Filesize
5KB

MD5
f3418a443e7d841097c714d69ec4bcb8

SHA1
49263695f6b0cdd72f45cf1b775e660fdc36c606

SHA256
6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770

SHA512
82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\NLROANQJ\favicon[1].ico

Filesize
99KB

MD5
9fcc2d2fe3e84c68413697adfd8843b8

SHA1
f94ad2d12b91f7b6befdc61662db00c41ce98410

SHA256
287ab5f17de4e9cf8332ba786d76ea65b70cd580d3d4b7f3c99d4f8c71fab440

SHA512
fc7db9d44a87878777e3ea1ab7cfc88b558f5766bd83fa8850aa9393aa953a087edcbf9b63b72ac38ab2880138a5ecbe8e23f7e43000761cf739fb0bbde56bd3

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\UFBNMNZG\favicon[1].ico

Filesize
66KB

MD5
72c17e495a03f0940f5086e9f1f1ff69

SHA1
22fdf73909c7f001a99cc5765ba4b084549aa334

SHA256
1a21d4c284833e91d97f6044a42a020b7ccba44cbbe9b58cf9fdd2db8e4f680e

SHA512
bbb723d9f3cf47dbb2a8e1de9c91db07640f7bd17b5a4ae30579329755b118d9b7291281e1fc6a5093fe1dfb5ad5f64e5d9f5a981f0d04c4d6c6b4719dace26b

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\LogFiles\edb.log

Filesize
512KB

MD5
e158378742aeb748a6ecad0887dd37dd

SHA1
5ee949367dfa1836ec1eac79b466d1683e2d53e4

SHA256
3cf21fec933643d126894397f1283d03bcd9f3b725f981a1f657e9ee3dee0f85

SHA512
a3d02fd28b18f514fc773026b8c90f181143fbca16ddde624d909cc00fa6309fcd17fd80a6bc8fcd7344ee98fbb718820dadfcf6d788af3a57f0e34590880a44

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\ImageStore\ku6lwtv\imagestore.dat

Filesize
172KB

MD5
c5a6fcd153108f31ea29ebe249f3cffe

SHA1
26252c5ce2b8802af89c3ba19a94c8867d3a041a

SHA256
63ed8e3758703f2ceaef149d37857e05b9384f8f8220e693e4c19b8ef46f3fc3

SHA512
8ee8078a986531eeb90efbce80e12e9a72594810bf7ab13fed053b3fc6e36108a18fa78da5e9e7faa842577655c2f8168edcc82b925c2c87620d9414516c51be

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Microsoft\Windows\3720402701\2219095117.pri

Filesize
207KB

MD5
e2b88765ee31470114e866d939a8f2c6

SHA1
e0a53b8511186ff308a0507b6304fb16cabd4e1f

SHA256
523e419d2fa2e780239812d36caa37e92f8c3e6a5cd9f18f0d807c593effa45e

SHA512
462e8e6b4e63fc6781b6a9935b332a1dc77bfb88e1de49134f86fd46bd1598d2e842902dd9415a328e325bd7cdee766bd9473f2695acdfa769ffe7ba9ae1953d

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\AY9MRO6Y\f[1].js

Filesize
1KB

MD5
a24a01d7c840115d8957289ec65da34f

SHA1
efca55f9df9a38ecad17c36a9108cab6017b5cfd

SHA256
4e683e575ca035ef147ae2b8984c2dcf1b885abc8f2e966db2e8c25b86cbb9e9

SHA512
244e6f2dbccd6f37aba3a32e7fb10534c17e9b858e97122a58e8f467e2c6a76dce1481f55e470a4f089081d553b5d58d23df83dac278d85de70082678868ff6e

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\AY9MRO6Y\jquery-3.3.1.min[1].js

Filesize
84KB

MD5
a09e13ee94d51c524b7e2a728c7d4039

SHA1
0dc32db4aa9c5f03f3b38c47d883dbd4fed13aae

SHA256
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

SHA512
f8da8f95b6ed33542a88af19028e18ae3d9ce25350a06bfc3fbf433ed2b38fefa5e639cddfdac703fc6caa7f3313d974b92a3168276b3a016ceb28f27db0714a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\U3CMTV34\JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCtr6Hw3aXo[1].woff2

Filesize
18KB

MD5
28ab3b0e8151123d4dc1d08197b61f8a

SHA1
7cb91342ce5dbc20a2378b5d5a85dea3f69467ea

SHA256
fbfb7cf0faeba70db28a9ed1a35b932b2a85bac25d27b1859befec067937393f

SHA512
12788bb3cea49ee0b3195d2e0588d7dfdb727a87592cc7772ccca81f4c58d9304f49d45347e9caad96334d451e17e4d4aeae98e1005d463aaf4870e34bc013e1

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\U3CMTV34\css[1].css

Filesize
208B

MD5
da15e40bf0fd8a5b633e8e8cc357bc63

SHA1
facccd1f9a14469512c31948b051da67d0e64813

SHA256
8b5e60d8ce4200e3eaf76c62d8291e9f75e220a33120c2baf31081e608dfcd28

SHA512
ae2f28723230150696f48aea807dc0bad9872f915c83ed564705f872a155979a45253326d5a2ca4f4f8e2747fac04b0144d9a8d03e4d355e8c53c08157c96db5

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\U3CMTV34\url[1].htm

Filesize
394B

MD5
7b17303ee43c587ea5bca1e82fc8c4e6

SHA1
99c5df78b09f3e9b0a8c5cf5a31209f3fd9d0d5a

SHA256
d6f1220be66d36c6fc72421d5e959e9e4d0f03ed2c827216c916f2e315634524

SHA512
72fc9851e7238412f88f89ace80b2b4597a920fd0f21ba9ce79d66f5a09fcc18ca75d7de72bcf80dae665e37ead340c4ef032d095d21c8f37e4008ae0cc3ac5d

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\VW4VS6OL\J2ULK8OF.htm

Filesize
17KB

MD5
e48bee51909055f33d0f28e52c0e566d

SHA1
6b65c1d3cad1168724ca5cbb1e904cd4edf7df92

SHA256
6fea32bebfc56174dfafec21f66d2e1984ba6248af66d97b3f7413f459fdbf53

SHA512
eecf88aa5ac92c431cbc87dee1f8ccaebbbfb8b34877b78e36a76bf4d76ccb5302bb3dbbea21b0c2ec0a700a11ab0b5aa488bceefb74cc25200e45bee68c77a8

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Filesize
2KB

MD5
de4be4c4e0e9cd4f8d9cbe736c23c184

SHA1
f46e03a991a06ba383ccd1d0a8a9a06426322dfa

SHA256
86d888eec3475b61914dfe4de9c29e55f7d382660a739cab5a200bd189048ec2

SHA512
8e6bba4416f6b7be02e94ae3ac8da5e20907136d12a8ee5257888cde98dc6093353460172d80b0d2271981ac0ff37ab678da95ef081c115fe0b47d9c90360096

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

Filesize
717B

MD5
60fe01df86be2e5331b0cdbe86165686

SHA1
2a79f9713c3f192862ff80508062e64e8e0b29bd

SHA256
c08ccbc876cd5a7cdfa9670f9637da57f6a1282198a9bc71fc7d7247a6e5b7a8

SHA512
ef9f9a4dedcbfe339f4f3d07fb614645596c6f2b15608bdccdad492578b735f7cb075bdaa07178c764582ee345857ec4665f90342694e6a60786bb3d9b3a3d23

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
b6c8cb62faf824bdfe0652395eefa98b

SHA1
dd366034ee8421336c61954cc3b7aba51f4b839b

SHA256
7abb08b450999af6597f28ea595ad10e002eeddc0438e7b347a04dba14d5da0b

SHA512
a352614b8f5920b7e3c5ce09f6b7b6bbdc763974887b31d756b98187e4e6e715eaa148a3f9c0e05b48b7b51583e40473cf2fef9db7aa137ba468be849d92d5ef

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_DE183C8BD2F85F62C6D4E33AB37362F1

Filesize
471B

MD5
2a2f84f23f13b9719a1ef5b836b4d9e6

SHA1
a68eea2c7e85a3744074dfda347131ac04f60820

SHA256
4896b8c48281cfa9ee3fbb5f3f8be5ec0233f458eece4dd7118bc03bee88148e

SHA512
ab83ad5bfa4f6d33de2d2f5e6ddafd3bcc2e4210ed39ea0e37095c32907316c6f62af67aebaacdaac91840fbfb65d65203a11f485cc7c28d4257b07600da4fba

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\4A804121E5D59A1E36CA0C5C4DA67985

Filesize
503B

MD5
ee631506138191867a1893f551247e52

SHA1
29dcf5b1a974fbc4b0c34eef4ebc2ff6d69fd648

SHA256
52aac944b31c3d4125d6e5d90f0dfa68c153000073f2716aa81c18d6c5c73f93

SHA512
f37248344bb2dfceb4853257825902ab7b7acbd82a643d73b0e04c9f815cead65ccaeed9beb2a42dbca3abd682703a3364a1f5aaef62d13b56a143404e41673d

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

Filesize
1KB

MD5
a55431e1c410fbaf03006832fc657661

SHA1
44a001963532faec3e83f32d703000f2ac291bc9

SHA256
05c4bfcc0eecd7cc492cb9866d42adbf2794546c5c3bd49ba7cbd5bf0c99df2e

SHA512
c8a6e14840249f09f964768f5546f8d6062cbc1f578943e4eb7f43546f4280af4a3b95b815d6285cd7f069dbd63f3dd81f695c9a64a419103454767b55e3a8e9

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_A373FEC5204D779A8604E28CC627A508

Filesize
1KB

MD5
a46c40884c234787b2c64b52ddb02146

SHA1
728a00b7b70e90e82ebf0cdd6e447ed8ecaa4a73

SHA256
9141b30fbf9dee038a32ee442bd45b3cdc9fd193f22177dd6da2208ba33a86af

SHA512
602a91b0ddb7f49548343179a76bd5df1d9b6ec8f8e13c2ee92bacda8926431ea8862cd7b1e925fa9a089790ff95636de4fcb037ec7c31e565f7936aefa648bb

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
1KB

MD5
26ddbe6a19c10cd59ba8e526eea7ba4b

SHA1
c656009d00e0df083371c94e45c1215d5badc200

SHA256
a43996cd78f46780f607a812c6bdb8f389feb17a3e9739ca7629b725f255ceb1

SHA512
1e4cd6289ed0b8415362d045ce4d76bef0c5d37384106414dcc17bf0e2708fab13c2fdbf397d14769985a2f0841d155fada106352813ef71ceb9a434396fac1c

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

Filesize
471B

MD5
1cbf5b5b5618f4e3acc7cb58d646af7b

SHA1
b9a22853075853808400edb822e487bbe016069d

SHA256
59f908c8f6368fb4ca038ea9e2384bdfca25e9fe0d6e42774e407e791f99f4e6

SHA512
2b94c4b1b5d78ff87737207f66d1d3a17d07e0c1b6cc1e7f9d71a97d13fb956fa9a2efea391d6d46828ac2726b0d025e504c59e833ba0d6b93bfe65fcefd2e48

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
aa62f8ce77e072c8160c71b5df3099b0

SHA1
06b8c07db93694a3fe73a4276283fabb0e20ac38

SHA256
3eb4927c4d9097dc924fcde21b56d01d5d1ef61b7d22bfb6786e3b546b33e176

SHA512
71724e837286c5f0eb2ee4ad01ac0304d4c7597bb2d46169c342821b0da04d8597491bd27ef80e817bc77031cd29d2182ccc82ef8ea3860696875f89427c8e0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_613BDE957D3B3963FB2B4F46E11452DB

Filesize
472B

MD5
02441e71b96dfcb212dc26c6742966fa

SHA1
893af98d5499b9838549a364494517859f99e38e

SHA256
2cffe2846eca0320d66174334f55ba35bd299aff59b40c730f7f4b179d542c7b

SHA512
aa07a01e4d26080b80f894080ae7bf303ae6e0d845fc98f5bf5a0bf79609dcec5144a67c7ac7b5e6894a5eb12f7f8bb5b061b63a2e4b5ce38a596e0823c5811f

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_0B931C13A5AA79B672090C0D1D0A52BE

Filesize
471B

MD5
abec0b27117032d4b87c029a25e2ce98

SHA1
4c80c24717da4be72fd100343c5e92c1724ccd74

SHA256
bc6bffd934c5172ab19ec9a41808b5543016f109670947e16c7ba285a295f606

SHA512
b11519dea1771236d2262660ea564ce23eceec3416928fa35bea1681415a50efcfce017b7ce14700575d19147214c96a8d2934cc738453109fad43bae0cf0c94

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Filesize
488B

MD5
8623ea2de49dea27ff6da669a0c20aa4

SHA1
caa604b4599ab15786e0b683304db66ab9ca2cac

SHA256
cfa57345a149872ec65ff819aa2fc6fae9b22706bcef40b1818ca8546a5a6ff7

SHA512
a5b9b9a12b8046355a6eaf43db7f725a91c0d9da1260cf10f6abf2b3719c7b3796a3ca02d6f8baad9a372e2a7107dfaae74cb204cf25ff3a15ca730427d2b8b7

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
a770069787069fb8157fefc91ddf6b29

SHA1
8b5f2aa52057a4bd634ef320a142c180ba5100ee

SHA256
9637d44d3d51112ce7f829b44bb3c249d3bad0c1810112d7d3725784eaf99372

SHA512
acbd4d0e199519edb04ad57ba3779db68c678b129648473ddcae04372aa67ace66f7c0cad1db80eb70d1ad68a0344dbbabaa3d529e37fe1d9f4f38d191b608ba

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
694d53e9c89c7733e141e948abd16784

SHA1
bd3927cab8906c35c11bfc83ebe97c26a64f8ed0

SHA256
f7ba941a823db5485dfc42c846c9ce802a27f2a3cbba841a4a0f41630b287afd

SHA512
bb0415707ce9bf824e37f243a4f1f4505f0e001dda4537b664ca26054d6fb8d5695b73611510a24e72c8b90997cf26a7a96f158023a592b79c6050fd0b674bed

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_DE183C8BD2F85F62C6D4E33AB37362F1

Filesize
414B

MD5
b8121b280798c500a6848b780e2391db

SHA1
3e7d0c972495db799ccd5c7c3e0d78665fe01d1d

SHA256
27c8ebe67cc2e124857849cb9153dd2864396ce9e5c586bee64d4de2ef5abc3e

SHA512
ba180aa964c3633e194edc09d529d5c309191bb50641b424e3398951ad0f08d412f046db44ae5b5dd840e0d777039d3176d402e93ee0eaf2f6d1fa0afd933d3b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\4A804121E5D59A1E36CA0C5C4DA67985

Filesize
552B

MD5
b77df88b4e71d9e2f694d9e101c903ba

SHA1
64825af2143c4ae5bf2dfdeb62a18d4185c54f17

SHA256
f065040c79c74eb2cedbb82642dca6f5a8a999e90c9c8e69e9a82f5e9df34d81

SHA512
458d8e5776982b8959a76b3e7119910887b914d21e604fef94b4390e18fd37efec24d3f79373d7609bcf55aaa88bc4be97f3b61ed128e06a2b08f11968b4d586

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

Filesize
438B

MD5
1055efb1563f5b4901a6140356532c71

SHA1
1dfae03779f7faf554838cbaa586a6156915218f

SHA256
ae5491150f5a5153ec24010afb3b509208d4a5073091b1b45e255dea432a619e

SHA512
257a625203edfaf3014c8730a4edce51b4eb3523054908ec571b93e5432ea75c765f34d3ecc5290991fbd7fd21bbb6d156b1a7db786449ddcda12749a3f2445d

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_A373FEC5204D779A8604E28CC627A508

Filesize
518B

MD5
42f12c4e9bc0420db89d0e8e74ccdc46

SHA1
747c953cab816ece6947cbd88eed9288209e3c61

SHA256
0ec7840ee0560f25acee0f899dc9c57a9e42dae011b7e05f9dd2de328a0b581a

SHA512
8d5bd86ef93c0742880e3d758bc7ec35afa5c9b0a228eed86ed5adb04a9692abb417dea562c59b3c2fdfb238979aa8711a5d065bc6df3795c07575e08462b9d6

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
482B

MD5
a4ffdad5016e55b4d03f1353cc7b89e6

SHA1
d13313f67e9f0581d19a347a3d0828fb436725c5

SHA256
88dcb7090bb6c49a28ecf0f4b25438e82217e88f9a23d151c7e906c345b4d2c9

SHA512
72ad22a19ab576cfe8b8ae1375c603d573d3cb30d58c9b3e0feceb782185fa59cbf898804be937c355dd16e26fc6e42b9aa952004be9924fa0099b4036dc44af

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

Filesize
400B

MD5
a77e533d6cf96501f40e457cdc1bf834

SHA1
ca3b42fa84683c388f70093d1e747507b74a5c50

SHA256
db98143bedaf41076dc70cf2af1fd5a06b47d581eabf81d6e055d0472fed028f

SHA512
325c0f083dc23f7e697bef6fc81cf0cf2ccce47e74af4f0fa7b1ce31b1c216210f7ccc1932198d00591f25529ef1006fb3c9b359059e71ae9d27723dc743e8a0

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
01986bed8985325745122ca27e832de3

SHA1
61d9870f1cacbdbe4435e39c04f123ba12c5107c

SHA256
29ac5fa4d7012b840b03eadbb20d7498613225aee3516c737af40ec405a2ee4d

SHA512
48c918a24ae18001b198d254d110cdaa7c43a4d8693cb0d5b6ba9f1b151836d486c7e610aff6be70c75cbfb18a5ba94a50ffbca1e869feefcde05cdab1bd5590

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_613BDE957D3B3963FB2B4F46E11452DB

Filesize
402B

MD5
2d1043785d135ecf8dd2d43fbb4fa2de

SHA1
9e36ed85b6dd611608bead265c959e7905b6587f

SHA256
8b3342c3bcb6e88161a2240a459ed1e88e2cc739761c305332b800f1284af2d2

SHA512
2bcfda74ed138d5206dd7895c8c2641f221f9c0da01b095175c8f0884366679b5207a106279a6cc3a7888622747c5df0d46dd02685173af7ec6ec56ad189e731

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_0B931C13A5AA79B672090C0D1D0A52BE

Filesize
406B

MD5
9a5a4f0c8cc6e7765e50f1467a549f71

SHA1
91a1ea7e93a0968d55598308d581ba8d21692afb

SHA256
6c602935ed98c7c241b29a1b0b7e6da5b2af1e90b64774188e231fdfccf050e7

SHA512
dca3311fdd59760c5bc72e35344ac6edef01b654ddff23839acf1e70695da136e9baa7a92c73cc1d66d46fcf6f2da476193d094b7ede6ef6c16df638e224b328

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\Windows\3720402701\2219095117.pri

Filesize
207KB

MD5
e2b88765ee31470114e866d939a8f2c6

SHA1
e0a53b8511186ff308a0507b6304fb16cabd4e1f

SHA256
523e419d2fa2e780239812d36caa37e92f8c3e6a5cd9f18f0d807c593effa45e

SHA512
462e8e6b4e63fc6781b6a9935b332a1dc77bfb88e1de49134f86fd46bd1598d2e842902dd9415a328e325bd7cdee766bd9473f2695acdfa769ffe7ba9ae1953d

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\HFESDE7A\favicon[1].ico

Filesize
5KB

MD5
f3418a443e7d841097c714d69ec4bcb8

SHA1
49263695f6b0cdd72f45cf1b775e660fdc36c606

SHA256
6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770

SHA512
82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\UFBNMNZG\favicon[1].ico

Filesize
66KB

MD5
72c17e495a03f0940f5086e9f1f1ff69

SHA1
22fdf73909c7f001a99cc5765ba4b084549aa334

SHA256
1a21d4c284833e91d97f6044a42a020b7ccba44cbbe9b58cf9fdd2db8e4f680e

SHA512
bbb723d9f3cf47dbb2a8e1de9c91db07640f7bd17b5a4ae30579329755b118d9b7291281e1fc6a5093fe1dfb5ad5f64e5d9f5a981f0d04c4d6c6b4719dace26b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\LogFiles\edb.log

Filesize
512KB

MD5
383111a915206e0cdbc003c3e54619c4

SHA1
a2dc85c6be90a601d08779f4f1ca39fe2ae705f1

SHA256
7b8e58a6a31e00d8f28c4bca719fc12bb696deb80d5c7fb102de1019440513f9

SHA512
3e6035e47511270bb13719f0f939d5fa063157a59697f34671d071b36b3a6b95a6f6a1e549c45c5c77843fcdb45acec17aed36e4ac79ff69d275ecea16d195c3

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\edb.chk

Filesize
8KB

MD5
429530a5516d10b6509f146ee42841d8

SHA1
017740e300be25c74095e1a4885d224f137aad8c

SHA256
47cbda7f26f52b645c8b1c365944eaaa5cc1c666b3c1d8e2716096b0d1574021

SHA512
ce46b15eaa84d71106cd61c6629ad9e65cc1b90005a1292073808562a1188fc8e14d60dfc9d15f468297cbeca2660036ef0b80b0028b9e15fc072baf94997f09

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\spartan.edb

Filesize
2.0MB

MD5
9648356a2629341476dffb33713240bb

SHA1
4df70e6a070a940cac4b9a00b91a926546dc1909

SHA256
dcf363d07bd8aa204f422933a397e7a284e8ddc3cf367d1a32e1ca1b4cfe7ff6

SHA512
c40c7bdd199ac5cc53bbc6d184f53a86136781694e06ac75f38e1a619258d840b8c4703321f347b9b379118f2f743924aadfa315436253d6c6f80b6dce7224e4

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\spartan.jfm

Filesize
16KB

MD5
2545423ba30fd95c02db0b5d735fdca3

SHA1
c7df8ee4f15628200bafc85c66cacc4ccb351935

SHA256
717854e00619efcd44ad65d8728796471e4110ca5628b7f098d34f80dc422f82

SHA512
adf29d9eab90c103128f5395b62bd4009cd9b546c1b4b68a01ff3527a858b36f791239d0f1dd3b36848c892f5da6549c3b244d2d152462ee46ebb3e85dc19bd1

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\ImageStore\ku6lwtv\imagestore.dat

Filesize
173KB

MD5
0f0e4c0f997b890f9db0ba1fb6260872

SHA1
29c4a242380282f1f5c6abdb6a0c33d380fca1c9

SHA256
6f65d3194e0c7c2d888f652c647181b66f2473be2f0f81afcd1b01cc522b5e68

SHA512
c1186a9c09393359c1f9e83b16a52456d3d039a41697621e486db7698de2773fdaf84140f0bfee869215c4cbc0bd5e7ff633b50a512f328e43df920cb0074119

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\Recovery\Active\RecoveryStore.{209E58C2-86C1-4416-BDE5-067158313B92}.dat

Filesize
4KB

MD5
ec517e784b8f8d6a77e338153555e8a2

SHA1
44c1843a0f9eef13620de1c36eb952ada859ef4e

SHA256
98f79cad7d0c032c0632e8e32ce590a3efea873e4d32dcdfec4af3c75ee41398

SHA512
1abc7360aeebc0221ebd3392a97c592850f150bf1e521149daf40cda4ba07b55a7527c229cfeed4f0da0819804135ae21637d38b68df5119fc35b399158960cd

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\Recovery\Active\{5A54D138-D533-497B-B0F0-DB6B1030BE31}.dat

Filesize
31KB

MD5
2c2376c0d431fd12aec0dc3aff3eeef1

SHA1
5c0ca9fd0385f2a6a24a3d1a97b0cb876c9523e8

SHA256
90049b7811b4c0cd1d19035ae997becc674c31b165256bd1dbc103d197e38e4c

SHA512
a148d3e7f33ab3a21f4e2069197e77e43744aefdef5d6bfbf9c0985a37ca981a05d1d2a4d5cb31a8b19ae6797c250f7d00e22bc3c8072fc17775deb501637261

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\Recovery\Active\{A036BFCC-C5DE-452D-9D21-BD360EE1F89F}.dat

Filesize
29KB

MD5
8d46d2f99ffe353c757de567b71d49ba

SHA1
7ecfd0f4c17fc65b60560fa19ecff21e3513f1c3

SHA256
f6234d4a3cca52409b026ff0173539baa7483934ea80660ed65f76ecbdd55f4b

SHA512
4efb8482b24f216b5ff34ddc2613279309e40f5789611380e06f45778752d31c56ce713a386b824a875846632addf0b460ebac916cf25f6ffe1fc58d58822c4e

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\Microsoft\Windows\3720402701\2219095117.pri

Filesize
207KB

MD5
e2b88765ee31470114e866d939a8f2c6

SHA1
e0a53b8511186ff308a0507b6304fb16cabd4e1f

SHA256
523e419d2fa2e780239812d36caa37e92f8c3e6a5cd9f18f0d807c593effa45e

SHA512
462e8e6b4e63fc6781b6a9935b332a1dc77bfb88e1de49134f86fd46bd1598d2e842902dd9415a328e325bd7cdee766bd9473f2695acdfa769ffe7ba9ae1953d

Download Submit
memory/4132-163-0x0000022EA2520000-0x0000022EA2530000-memory.dmp

Filesize
64KB

Download
memory/4132-248-0x0000022EA88E0000-0x0000022EA88E1000-memory.dmp

Filesize
4KB

Download
memory/4132-181-0x0000022EA2D00000-0x0000022EA2D10000-memory.dmp

Filesize
64KB

Download
memory/4132-200-0x0000022EA26E0000-0x0000022EA26E1000-memory.dmp

Filesize
4KB

Download
memory/4132-247-0x0000022EA88D0000-0x0000022EA88D1000-memory.dmp

Filesize
4KB

Download
memory/4132-202-0x0000022EA2920000-0x0000022EA2922000-memory.dmp

Filesize
8KB

Download
memory/4132-204-0x0000022EA6FC0000-0x0000022EA6FC2000-memory.dmp

Filesize
8KB

Download
memory/4132-205-0x0000022EA7020000-0x0000022EA7022000-memory.dmp

Filesize
8KB

Download
memory/4480-331-0x000002BBB0BD0000-0x000002BBB0BD2000-memory.dmp

Filesize
8KB

Download
memory/4480-345-0x000002BBB1380000-0x000002BBB1382000-memory.dmp

Filesize
8KB

Download
memory/4480-365-0x000002BBB04C0000-0x000002BBB04C2000-memory.dmp

Filesize
8KB

Download
memory/4480-356-0x000002BBB15E0000-0x000002BBB15E2000-memory.dmp

Filesize
8KB

Download
memory/4480-242-0x000002BBAFDF0000-0x000002BBAFDF2000-memory.dmp

Filesize
8KB

Download
memory/4480-354-0x000002BBB15C0000-0x000002BBB15C2000-memory.dmp

Filesize
8KB

Download
memory/4480-329-0x000002BBB0BB0000-0x000002BBB0BB2000-memory.dmp

Filesize
8KB

Download
memory/4480-349-0x000002BBB13B0000-0x000002BBB13B2000-memory.dmp

Filesize
8KB

Download
memory/4480-333-0x000002BBB0BF0000-0x000002BBB0BF2000-memory.dmp

Filesize
8KB

Download
memory/4480-347-0x000002BBB13A0000-0x000002BBB13A2000-memory.dmp

Filesize
8KB

Download
memory/4480-376-0x000002BBAF940000-0x000002BBAF942000-memory.dmp

Filesize
8KB

Download
memory/4480-380-0x000002BBAFB40000-0x000002BBAFB42000-memory.dmp

Filesize
8KB

Download
memory/4480-239-0x000002BBAFDD0000-0x000002BBAFDD2000-memory.dmp

Filesize
8KB

Download
memory/4480-363-0x000002BB9F330000-0x000002BB9F332000-memory.dmp

Filesize
8KB

Download
memory/4480-343-0x000002BBB12E0000-0x000002BBB12E2000-memory.dmp

Filesize
8KB

Download
memory/4480-235-0x000002BBAFD10000-0x000002BBAFD12000-memory.dmp

Filesize
8KB

Download
memory/4480-233-0x000002BBAFBF0000-0x000002BBAFBF2000-memory.dmp

Filesize
8KB

Download
memory/4480-337-0x000002BBB1120000-0x000002BBB1122000-memory.dmp

Filesize
8KB

Download
memory/4480-327-0x000002BBB0BA0000-0x000002BBB0BA2000-memory.dmp

Filesize
8KB

Download
memory/4480-367-0x000002BBB04D0000-0x000002BBB04D2000-memory.dmp

Filesize
8KB

Download
memory/4480-341-0x000002BBB12B0000-0x000002BBB12B2000-memory.dmp

Filesize
8KB

Download
memory/4480-339-0x000002BBB1280000-0x000002BBB1282000-memory.dmp

Filesize
8KB

Download
memory/4480-369-0x000002BBB0700000-0x000002BBB0702000-memory.dmp

Filesize
8KB

Download
memory/4480-320-0x000002BBB0B80000-0x000002BBB0B82000-memory.dmp

Filesize
8KB

Download
memory/4480-301-0x000002BB9F700000-0x000002BB9F800000-memory.dmp

Filesize
1024KB

Download