Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
25/05/2023, 19:48
230525-yh3tkacg61 525/05/2023, 19:46
230525-yhcx5sca93 525/05/2023, 19:33
230525-x9vrlaca49 525/05/2023, 19:33
230525-x9k76acg2t 525/05/2023, 19:27
230525-x59d7acf5t 5Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
25/05/2023, 19:48
Behavioral task
behavioral1
Sample
@lbzvm+s8460+397+6728+591+46 5+6684+ zbdovis+ 2839+8045.pdf
Resource
win10-20230220-en
General
-
Target
@lbzvm+s8460+397+6728+591+46 5+6684+ zbdovis+ 2839+8045.pdf
-
Size
33KB
-
MD5
d3945d4eab98cf2d48e34cff91a3c843
-
SHA1
a73d10b005208c06ab772c635d581473dcfeaf20
-
SHA256
18a29ebd902a52add72e3eecb6a234e221fb91b24ae776394703b2c138beacb1
-
SHA512
4006351b7b9df138115ed0f4e893cb025c492fcb2f9b6f221eb1ba741be89572cb0ccc4cb8edcd0b5bad93606dc0f53b50d858bb3e648516e85ca5f86c269608
-
SSDEEP
768:C4/gHYX/wnbFDyzeD1Wkzu30XkLGHj+4R0EzkavINL+xPt1xv:v0YX4nxD0eJXU6+4MqI1aZv
Malware Config
Signatures
-
Drops file in Windows directory 7 IoCs
description ioc Process File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdge.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdge.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = bef156ad528fd901 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 34ff74d6528fd901 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\ = "0" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\LastClosedHeight = "648" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\Total\ = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "256000" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CRLs MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\bing.com\NumberOfSubdomain = "0" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com\ = "652" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\LastClosedWidth = "800" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 30e8b0db528fd901 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DOMStorage MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Settings\Cache\History\CacheLimit = "1" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\ClearBrowsingHistoryOnStart = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B72164 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$blogger MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\EnableNegotiate = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "268435456" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\MigrationTime = 84a3779c5945d901 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\DetectPhoneNumberCompleted = "1" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = 010000002dd27c803d1c0b1d8b3b39f196ec130e05b184e6c2cf9f9e822fb60674dc2bdf6e72e09db2dc72db0419c5825befc4ca5ac927e0cc26f6991c4b81f46f294db3caaa4490aad109d51e59e6bde0ce3bc2fc4ac68f6142db11e217d01e08637909a71c926c511c9198c69a8c992eabf02e39d554ea184383397b35b9b652aa93f3cd6781085cdb9f7daf7c4282b6a44d84a1081089e04844694a44614b3d1e7bf9b42bd322ea2f6832ac9fb1a408dba8603a850cd6ed738293f8e3896a26df2d38aa086419c1386598c8a32775a06e5f4c30eabdcc36e3530c5eb4db565b0da641b49e082f76172df065299f0f0b7fb14b98d8244538b839981b5600c572c848da6d8dde637ceae3564fcfd9cea22c7b3d31f010d73a12a0d6ec6836b30d3008807b7595d8add2079010361fe33d97000cc4d00945bb107ff20a8cd748e165abc402f629c931f04128ecfe39ff87defcb1721a097bc4d447a7616189c8f987067203b0140f1b6235d98ac7371115231e011c6cf31f3d7dd397c986f096e0b65a887e43563be949034d8c31510c8b849a4ee3678aae2e2bc2ef06cbd201f971576781058e1cd7a1 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames\ MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Settings\Cache\History MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 88bae5b3528fd901 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CacheLimit = "1" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData\RulesFileNextUpdateDate = "391213431" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "1" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\Total = "604" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\AllComplete = "1" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites\Order = 0c0000000a000000000000000c0000000100000000000000 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionI MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 2448 AcroRd32.exe 2448 AcroRd32.exe 2448 AcroRd32.exe 2448 AcroRd32.exe 2448 AcroRd32.exe 2448 AcroRd32.exe 2448 AcroRd32.exe 2448 AcroRd32.exe 2448 AcroRd32.exe 2448 AcroRd32.exe 2448 AcroRd32.exe 2448 AcroRd32.exe 2448 AcroRd32.exe 2448 AcroRd32.exe 2448 AcroRd32.exe 2448 AcroRd32.exe 2448 AcroRd32.exe 2448 AcroRd32.exe 2448 AcroRd32.exe 2448 AcroRd32.exe -
Suspicious behavior: MapViewOfSection 8 IoCs
pid Process 312 MicrosoftEdgeCP.exe 312 MicrosoftEdgeCP.exe 312 MicrosoftEdgeCP.exe 312 MicrosoftEdgeCP.exe 4396 MicrosoftEdgeCP.exe 4396 MicrosoftEdgeCP.exe 4396 MicrosoftEdgeCP.exe 4396 MicrosoftEdgeCP.exe -
Suspicious use of AdjustPrivilegeToken 27 IoCs
description pid Process Token: SeDebugPrivilege 4132 MicrosoftEdge.exe Token: SeDebugPrivilege 4132 MicrosoftEdge.exe Token: SeDebugPrivilege 4132 MicrosoftEdge.exe Token: SeDebugPrivilege 4132 MicrosoftEdge.exe Token: SeDebugPrivilege 4480 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4480 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4480 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4480 MicrosoftEdgeCP.exe Token: SeShutdownPrivilege 4480 MicrosoftEdgeCP.exe Token: SeCreatePagefilePrivilege 4480 MicrosoftEdgeCP.exe Token: SeShutdownPrivilege 4480 MicrosoftEdgeCP.exe Token: SeCreatePagefilePrivilege 4480 MicrosoftEdgeCP.exe Token: SeShutdownPrivilege 4480 MicrosoftEdgeCP.exe Token: SeCreatePagefilePrivilege 4480 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 1432 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 1432 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4132 MicrosoftEdge.exe Token: SeShutdownPrivilege 5044 MicrosoftEdgeCP.exe Token: SeCreatePagefilePrivilege 5044 MicrosoftEdgeCP.exe Token: SeShutdownPrivilege 5044 MicrosoftEdgeCP.exe Token: SeCreatePagefilePrivilege 5044 MicrosoftEdgeCP.exe Token: SeShutdownPrivilege 5044 MicrosoftEdgeCP.exe Token: SeCreatePagefilePrivilege 5044 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 2084 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 2084 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 2084 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 2084 MicrosoftEdgeCP.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2448 AcroRd32.exe -
Suspicious use of SendNotifyMessage 9 IoCs
pid Process 2448 AcroRd32.exe 2448 AcroRd32.exe 2448 AcroRd32.exe 2448 AcroRd32.exe 2448 AcroRd32.exe 2448 AcroRd32.exe 2448 AcroRd32.exe 2448 AcroRd32.exe 2448 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 2448 AcroRd32.exe 2448 AcroRd32.exe 2448 AcroRd32.exe 2448 AcroRd32.exe 2448 AcroRd32.exe 2448 AcroRd32.exe 4132 MicrosoftEdge.exe 312 MicrosoftEdgeCP.exe 312 MicrosoftEdgeCP.exe 2176 MicrosoftEdge.exe 4396 MicrosoftEdgeCP.exe 4396 MicrosoftEdgeCP.exe 2084 MicrosoftEdgeCP.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2448 wrote to memory of 4940 2448 AcroRd32.exe 66 PID 2448 wrote to memory of 4940 2448 AcroRd32.exe 66 PID 2448 wrote to memory of 4940 2448 AcroRd32.exe 66 PID 4940 wrote to memory of 3124 4940 RdrCEF.exe 67 PID 4940 wrote to memory of 3124 4940 RdrCEF.exe 67 PID 4940 wrote to memory of 3124 4940 RdrCEF.exe 67 PID 4940 wrote to memory of 3124 4940 RdrCEF.exe 67 PID 4940 wrote to memory of 3124 4940 RdrCEF.exe 67 PID 4940 wrote to memory of 3124 4940 RdrCEF.exe 67 PID 4940 wrote to memory of 3124 4940 RdrCEF.exe 67 PID 4940 wrote to memory of 3124 4940 RdrCEF.exe 67 PID 4940 wrote to memory of 3124 4940 RdrCEF.exe 67 PID 4940 wrote to memory of 3124 4940 RdrCEF.exe 67 PID 4940 wrote to memory of 3124 4940 RdrCEF.exe 67 PID 4940 wrote to memory of 3124 4940 RdrCEF.exe 67 PID 4940 wrote to memory of 3124 4940 RdrCEF.exe 67 PID 4940 wrote to memory of 3124 4940 RdrCEF.exe 67 PID 4940 wrote to memory of 3124 4940 RdrCEF.exe 67 PID 4940 wrote to memory of 3124 4940 RdrCEF.exe 67 PID 4940 wrote to memory of 3124 4940 RdrCEF.exe 67 PID 4940 wrote to memory of 3124 4940 RdrCEF.exe 67 PID 4940 wrote to memory of 3124 4940 RdrCEF.exe 67 PID 4940 wrote to memory of 3124 4940 RdrCEF.exe 67 PID 4940 wrote to memory of 3124 4940 RdrCEF.exe 67 PID 4940 wrote to memory of 3124 4940 RdrCEF.exe 67 PID 4940 wrote to memory of 3124 4940 RdrCEF.exe 67 PID 4940 wrote to memory of 3124 4940 RdrCEF.exe 67 PID 4940 wrote to memory of 3124 4940 RdrCEF.exe 67 PID 4940 wrote to memory of 3124 4940 RdrCEF.exe 67 PID 4940 wrote to memory of 3124 4940 RdrCEF.exe 67 PID 4940 wrote to memory of 3124 4940 RdrCEF.exe 67 PID 4940 wrote to memory of 3124 4940 RdrCEF.exe 67 PID 4940 wrote to memory of 3124 4940 RdrCEF.exe 67 PID 4940 wrote to memory of 3124 4940 RdrCEF.exe 67 PID 4940 wrote to memory of 3124 4940 RdrCEF.exe 67 PID 4940 wrote to memory of 3124 4940 RdrCEF.exe 67 PID 4940 wrote to memory of 3124 4940 RdrCEF.exe 67 PID 4940 wrote to memory of 3124 4940 RdrCEF.exe 67 PID 4940 wrote to memory of 3124 4940 RdrCEF.exe 67 PID 4940 wrote to memory of 3124 4940 RdrCEF.exe 67 PID 4940 wrote to memory of 3124 4940 RdrCEF.exe 67 PID 4940 wrote to memory of 3124 4940 RdrCEF.exe 67 PID 4940 wrote to memory of 3124 4940 RdrCEF.exe 67 PID 4940 wrote to memory of 3124 4940 RdrCEF.exe 67 PID 4940 wrote to memory of 2904 4940 RdrCEF.exe 68 PID 4940 wrote to memory of 2904 4940 RdrCEF.exe 68 PID 4940 wrote to memory of 2904 4940 RdrCEF.exe 68 PID 4940 wrote to memory of 2904 4940 RdrCEF.exe 68 PID 4940 wrote to memory of 2904 4940 RdrCEF.exe 68 PID 4940 wrote to memory of 2904 4940 RdrCEF.exe 68 PID 4940 wrote to memory of 2904 4940 RdrCEF.exe 68 PID 4940 wrote to memory of 2904 4940 RdrCEF.exe 68 PID 4940 wrote to memory of 2904 4940 RdrCEF.exe 68 PID 4940 wrote to memory of 2904 4940 RdrCEF.exe 68 PID 4940 wrote to memory of 2904 4940 RdrCEF.exe 68 PID 4940 wrote to memory of 2904 4940 RdrCEF.exe 68 PID 4940 wrote to memory of 2904 4940 RdrCEF.exe 68 PID 4940 wrote to memory of 2904 4940 RdrCEF.exe 68 PID 4940 wrote to memory of 2904 4940 RdrCEF.exe 68 PID 4940 wrote to memory of 2904 4940 RdrCEF.exe 68 PID 4940 wrote to memory of 2904 4940 RdrCEF.exe 68 PID 4940 wrote to memory of 2904 4940 RdrCEF.exe 68 PID 4940 wrote to memory of 2904 4940 RdrCEF.exe 68 PID 4940 wrote to memory of 2904 4940 RdrCEF.exe 68
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\@lbzvm+s8460+397+6728+591+46 5+6684+ zbdovis+ 2839+8045.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=1121F93BCD3FAC81B9AC4620F39ADB07 --mojo-platform-channel-handle=1628 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3124
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=68A049E27C5CF266A1ED191A6BD41E15 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=68A049E27C5CF266A1ED191A6BD41E15 --renderer-client-id=2 --mojo-platform-channel-handle=1664 --allow-no-sandbox-job /prefetch:13⤵PID:2904
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=0637FCD9C78272CE0A429A836AE0CE01 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=0637FCD9C78272CE0A429A836AE0CE01 --renderer-client-id=4 --mojo-platform-channel-handle=2064 --allow-no-sandbox-job /prefetch:13⤵PID:1476
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=034959297DC1E70E6EAA8AE95F3A5F68 --mojo-platform-channel-handle=2472 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3828
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7C0CB0C4EBB4047E9039098CF32BFB83 --mojo-platform-channel-handle=2568 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4840
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=8DB4A61076E0ADD50122792136EBD193 --mojo-platform-channel-handle=2604 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:768
-
-
-
C:\Windows\SysWOW64\LaunchWinApp.exe"C:\Windows\system32\LaunchWinApp.exe" "https://www.google.com/url?q=https%3a%2f%2faction-get-new.fun%2falcQWH4Jx5%23ebytqxni&sa=D&sntz=1&usg=AOvVaw0kJ8n_mmxdc911W010X3-H"2⤵PID:4472
-
-
C:\Windows\SysWOW64\LaunchWinApp.exe"C:\Windows\system32\LaunchWinApp.exe" "https://www.google.com/url?q=https%3a%2f%2faction-get-new.fun%2falcQWH4Jx5%23ebytqxni&sa=D&sntz=1&usg=AOvVaw0kJ8n_mmxdc911W010X3-H"2⤵PID:1392
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4132
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:5096
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:312
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4480
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1432
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
PID:2200
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:4168
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2176
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:4280
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:4396
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5044
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2084
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74KB
MD5d4fc49dc14f63895d997fa4940f24378
SHA13efb1437a7c5e46034147cbbc8db017c69d02c31
SHA256853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1
SHA512cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\6W9DVHZ9\script[1].js
Filesize266KB
MD52fceca9c9c3a844bebbd26dabfb3ab88
SHA18d701f2ba8caa71d80c86d91cfec71feddb519fe
SHA25604d1d1916ce115057f37990dc90a883df8d6ad4a0164e4328e7e93b0b3779766
SHA512736560fd820a67159e58c505da9f4d702bf68009af43f696852dad0a362e02adc9eddd60e9eabd16737dfd0b25994b2272a83c1cafc3ce39e1dcbeeccec66afa
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\6W9DVHZ9\style[1].css
Filesize476KB
MD5f9ef64283b5dcc83b5337d7869c86b96
SHA180375f6b9504014d7efc3aaa5b7cc9a931e65e99
SHA256511c3a3fe26e62d2fe113f6314ae2193a3fe9d167cef3d30168cc0a556ce2100
SHA5128df2922ddc9ea83a41c483655aa5bbc3824a1dcc9ba523bfbad0127acf377d56f2fa0fafd8f0746ab7ad2120c02d7fea5111b3b8fe39263fe31ca8fecac1a27e
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\U3CMTV34\js[1].js
Filesize221KB
MD56a587173684b74bf5c9da42f2ebbd8cb
SHA13d50e5e3afcebe949c5790cde9d9d8c35c0a7491
SHA256c21a014f70825477f8636f7dfecb72a2e95fc15400138da3a26a7f6ec6169f81
SHA5128b05dc97665f8f005609268cc45af449c3cd3bb928eec03a980793711709e54f9c57a479da685c071346eb2b61bf471746c9dbb99b7bd50cb73a27c20b7775bc
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\VW4VS6OL\p[1].js
Filesize375B
MD508d4f1f01af88a5f659d061ed01725a2
SHA18e7efa1c2a210d631724de9c6583d292b1eac3f5
SHA256d1fc940d7d8316fa83e0614c91c9e8494a060954078101a7b11ad72e305b4b02
SHA512450e82472f509104f5a88da5627ee20db28ee92fda125870a8daef9e66342e8d6bedade9c6baba855664d4723bb6cff8136c1d8e554608a0d2a90b5668d5057e
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!002\MicrosoftEdge\User\Default\DOMStore\ZQPRNHVE\www.bing[1].xml
Filesize1KB
MD5d17c4c8874bbd8715504a10da8b7fd62
SHA18e6a0f1b6915a7fb9d0030d9ac06695a9f290684
SHA256d4ab229353e9033c42c1ceb19b54d0dc086ecc60cb28bb70f2fc3d0b9e3ecbe4
SHA512fe44408aff1ab74b285c4ecf7103e206847f6ae99a81178e1f0e630c4e157efa5a2242289758802d50f5af870a5a5d0fa07d0acd29d58bf712b03574aba2e363
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\BY67WOT4\suggestions[1].en-US
Filesize17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\HFESDE7A\favicon[1].ico
Filesize5KB
MD5f3418a443e7d841097c714d69ec4bcb8
SHA149263695f6b0cdd72f45cf1b775e660fdc36c606
SHA2566da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770
SHA51282d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\NLROANQJ\favicon[1].ico
Filesize99KB
MD59fcc2d2fe3e84c68413697adfd8843b8
SHA1f94ad2d12b91f7b6befdc61662db00c41ce98410
SHA256287ab5f17de4e9cf8332ba786d76ea65b70cd580d3d4b7f3c99d4f8c71fab440
SHA512fc7db9d44a87878777e3ea1ab7cfc88b558f5766bd83fa8850aa9393aa953a087edcbf9b63b72ac38ab2880138a5ecbe8e23f7e43000761cf739fb0bbde56bd3
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\UFBNMNZG\favicon[1].ico
Filesize66KB
MD572c17e495a03f0940f5086e9f1f1ff69
SHA122fdf73909c7f001a99cc5765ba4b084549aa334
SHA2561a21d4c284833e91d97f6044a42a020b7ccba44cbbe9b58cf9fdd2db8e4f680e
SHA512bbb723d9f3cf47dbb2a8e1de9c91db07640f7bd17b5a4ae30579329755b118d9b7291281e1fc6a5093fe1dfb5ad5f64e5d9f5a981f0d04c4d6c6b4719dace26b
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\LogFiles\edb.log
Filesize512KB
MD5e158378742aeb748a6ecad0887dd37dd
SHA15ee949367dfa1836ec1eac79b466d1683e2d53e4
SHA2563cf21fec933643d126894397f1283d03bcd9f3b725f981a1f657e9ee3dee0f85
SHA512a3d02fd28b18f514fc773026b8c90f181143fbca16ddde624d909cc00fa6309fcd17fd80a6bc8fcd7344ee98fbb718820dadfcf6d788af3a57f0e34590880a44
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\ImageStore\ku6lwtv\imagestore.dat
Filesize172KB
MD5c5a6fcd153108f31ea29ebe249f3cffe
SHA126252c5ce2b8802af89c3ba19a94c8867d3a041a
SHA25663ed8e3758703f2ceaef149d37857e05b9384f8f8220e693e4c19b8ef46f3fc3
SHA5128ee8078a986531eeb90efbce80e12e9a72594810bf7ab13fed053b3fc6e36108a18fa78da5e9e7faa842577655c2f8168edcc82b925c2c87620d9414516c51be
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Microsoft\Windows\3720402701\2219095117.pri
Filesize207KB
MD5e2b88765ee31470114e866d939a8f2c6
SHA1e0a53b8511186ff308a0507b6304fb16cabd4e1f
SHA256523e419d2fa2e780239812d36caa37e92f8c3e6a5cd9f18f0d807c593effa45e
SHA512462e8e6b4e63fc6781b6a9935b332a1dc77bfb88e1de49134f86fd46bd1598d2e842902dd9415a328e325bd7cdee766bd9473f2695acdfa769ffe7ba9ae1953d
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\AY9MRO6Y\f[1].js
Filesize1KB
MD5a24a01d7c840115d8957289ec65da34f
SHA1efca55f9df9a38ecad17c36a9108cab6017b5cfd
SHA2564e683e575ca035ef147ae2b8984c2dcf1b885abc8f2e966db2e8c25b86cbb9e9
SHA512244e6f2dbccd6f37aba3a32e7fb10534c17e9b858e97122a58e8f467e2c6a76dce1481f55e470a4f089081d553b5d58d23df83dac278d85de70082678868ff6e
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\AY9MRO6Y\jquery-3.3.1.min[1].js
Filesize84KB
MD5a09e13ee94d51c524b7e2a728c7d4039
SHA10dc32db4aa9c5f03f3b38c47d883dbd4fed13aae
SHA256160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
SHA512f8da8f95b6ed33542a88af19028e18ae3d9ce25350a06bfc3fbf433ed2b38fefa5e639cddfdac703fc6caa7f3313d974b92a3168276b3a016ceb28f27db0714a
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\U3CMTV34\JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCtr6Hw3aXo[1].woff2
Filesize18KB
MD528ab3b0e8151123d4dc1d08197b61f8a
SHA17cb91342ce5dbc20a2378b5d5a85dea3f69467ea
SHA256fbfb7cf0faeba70db28a9ed1a35b932b2a85bac25d27b1859befec067937393f
SHA51212788bb3cea49ee0b3195d2e0588d7dfdb727a87592cc7772ccca81f4c58d9304f49d45347e9caad96334d451e17e4d4aeae98e1005d463aaf4870e34bc013e1
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\U3CMTV34\css[1].css
Filesize208B
MD5da15e40bf0fd8a5b633e8e8cc357bc63
SHA1facccd1f9a14469512c31948b051da67d0e64813
SHA2568b5e60d8ce4200e3eaf76c62d8291e9f75e220a33120c2baf31081e608dfcd28
SHA512ae2f28723230150696f48aea807dc0bad9872f915c83ed564705f872a155979a45253326d5a2ca4f4f8e2747fac04b0144d9a8d03e4d355e8c53c08157c96db5
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\U3CMTV34\url[1].htm
Filesize394B
MD57b17303ee43c587ea5bca1e82fc8c4e6
SHA199c5df78b09f3e9b0a8c5cf5a31209f3fd9d0d5a
SHA256d6f1220be66d36c6fc72421d5e959e9e4d0f03ed2c827216c916f2e315634524
SHA51272fc9851e7238412f88f89ace80b2b4597a920fd0f21ba9ce79d66f5a09fcc18ca75d7de72bcf80dae665e37ead340c4ef032d095d21c8f37e4008ae0cc3ac5d
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\VW4VS6OL\J2ULK8OF.htm
Filesize17KB
MD5e48bee51909055f33d0f28e52c0e566d
SHA16b65c1d3cad1168724ca5cbb1e904cd4edf7df92
SHA2566fea32bebfc56174dfafec21f66d2e1984ba6248af66d97b3f7413f459fdbf53
SHA512eecf88aa5ac92c431cbc87dee1f8ccaebbbfb8b34877b78e36a76bf4d76ccb5302bb3dbbea21b0c2ec0a700a11ab0b5aa488bceefb74cc25200e45bee68c77a8
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
Filesize2KB
MD5de4be4c4e0e9cd4f8d9cbe736c23c184
SHA1f46e03a991a06ba383ccd1d0a8a9a06426322dfa
SHA25686d888eec3475b61914dfe4de9c29e55f7d382660a739cab5a200bd189048ec2
SHA5128e6bba4416f6b7be02e94ae3ac8da5e20907136d12a8ee5257888cde98dc6093353460172d80b0d2271981ac0ff37ab678da95ef081c115fe0b47d9c90360096
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Filesize717B
MD560fe01df86be2e5331b0cdbe86165686
SHA12a79f9713c3f192862ff80508062e64e8e0b29bd
SHA256c08ccbc876cd5a7cdfa9670f9637da57f6a1282198a9bc71fc7d7247a6e5b7a8
SHA512ef9f9a4dedcbfe339f4f3d07fb614645596c6f2b15608bdccdad492578b735f7cb075bdaa07178c764582ee345857ec4665f90342694e6a60786bb3d9b3a3d23
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize1KB
MD5b6c8cb62faf824bdfe0652395eefa98b
SHA1dd366034ee8421336c61954cc3b7aba51f4b839b
SHA2567abb08b450999af6597f28ea595ad10e002eeddc0438e7b347a04dba14d5da0b
SHA512a352614b8f5920b7e3c5ce09f6b7b6bbdc763974887b31d756b98187e4e6e715eaa148a3f9c0e05b48b7b51583e40473cf2fef9db7aa137ba468be849d92d5ef
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_DE183C8BD2F85F62C6D4E33AB37362F1
Filesize471B
MD52a2f84f23f13b9719a1ef5b836b4d9e6
SHA1a68eea2c7e85a3744074dfda347131ac04f60820
SHA2564896b8c48281cfa9ee3fbb5f3f8be5ec0233f458eece4dd7118bc03bee88148e
SHA512ab83ad5bfa4f6d33de2d2f5e6ddafd3bcc2e4210ed39ea0e37095c32907316c6f62af67aebaacdaac91840fbfb65d65203a11f485cc7c28d4257b07600da4fba
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\4A804121E5D59A1E36CA0C5C4DA67985
Filesize503B
MD5ee631506138191867a1893f551247e52
SHA129dcf5b1a974fbc4b0c34eef4ebc2ff6d69fd648
SHA25652aac944b31c3d4125d6e5d90f0dfa68c153000073f2716aa81c18d6c5c73f93
SHA512f37248344bb2dfceb4853257825902ab7b7acbd82a643d73b0e04c9f815cead65ccaeed9beb2a42dbca3abd682703a3364a1f5aaef62d13b56a143404e41673d
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
Filesize1KB
MD5a55431e1c410fbaf03006832fc657661
SHA144a001963532faec3e83f32d703000f2ac291bc9
SHA25605c4bfcc0eecd7cc492cb9866d42adbf2794546c5c3bd49ba7cbd5bf0c99df2e
SHA512c8a6e14840249f09f964768f5546f8d6062cbc1f578943e4eb7f43546f4280af4a3b95b815d6285cd7f069dbd63f3dd81f695c9a64a419103454767b55e3a8e9
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_A373FEC5204D779A8604E28CC627A508
Filesize1KB
MD5a46c40884c234787b2c64b52ddb02146
SHA1728a00b7b70e90e82ebf0cdd6e447ed8ecaa4a73
SHA2569141b30fbf9dee038a32ee442bd45b3cdc9fd193f22177dd6da2208ba33a86af
SHA512602a91b0ddb7f49548343179a76bd5df1d9b6ec8f8e13c2ee92bacda8926431ea8862cd7b1e925fa9a089790ff95636de4fcb037ec7c31e565f7936aefa648bb
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
Filesize1KB
MD526ddbe6a19c10cd59ba8e526eea7ba4b
SHA1c656009d00e0df083371c94e45c1215d5badc200
SHA256a43996cd78f46780f607a812c6bdb8f389feb17a3e9739ca7629b725f255ceb1
SHA5121e4cd6289ed0b8415362d045ce4d76bef0c5d37384106414dcc17bf0e2708fab13c2fdbf397d14769985a2f0841d155fada106352813ef71ceb9a434396fac1c
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
Filesize471B
MD51cbf5b5b5618f4e3acc7cb58d646af7b
SHA1b9a22853075853808400edb822e487bbe016069d
SHA25659f908c8f6368fb4ca038ea9e2384bdfca25e9fe0d6e42774e407e791f99f4e6
SHA5122b94c4b1b5d78ff87737207f66d1d3a17d07e0c1b6cc1e7f9d71a97d13fb956fa9a2efea391d6d46828ac2726b0d025e504c59e833ba0d6b93bfe65fcefd2e48
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize724B
MD5aa62f8ce77e072c8160c71b5df3099b0
SHA106b8c07db93694a3fe73a4276283fabb0e20ac38
SHA2563eb4927c4d9097dc924fcde21b56d01d5d1ef61b7d22bfb6786e3b546b33e176
SHA51271724e837286c5f0eb2ee4ad01ac0304d4c7597bb2d46169c342821b0da04d8597491bd27ef80e817bc77031cd29d2182ccc82ef8ea3860696875f89427c8e0a
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_613BDE957D3B3963FB2B4F46E11452DB
Filesize472B
MD502441e71b96dfcb212dc26c6742966fa
SHA1893af98d5499b9838549a364494517859f99e38e
SHA2562cffe2846eca0320d66174334f55ba35bd299aff59b40c730f7f4b179d542c7b
SHA512aa07a01e4d26080b80f894080ae7bf303ae6e0d845fc98f5bf5a0bf79609dcec5144a67c7ac7b5e6894a5eb12f7f8bb5b061b63a2e4b5ce38a596e0823c5811f
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_0B931C13A5AA79B672090C0D1D0A52BE
Filesize471B
MD5abec0b27117032d4b87c029a25e2ce98
SHA14c80c24717da4be72fd100343c5e92c1724ccd74
SHA256bc6bffd934c5172ab19ec9a41808b5543016f109670947e16c7ba285a295f606
SHA512b11519dea1771236d2262660ea564ce23eceec3416928fa35bea1681415a50efcfce017b7ce14700575d19147214c96a8d2934cc738453109fad43bae0cf0c94
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
Filesize488B
MD58623ea2de49dea27ff6da669a0c20aa4
SHA1caa604b4599ab15786e0b683304db66ab9ca2cac
SHA256cfa57345a149872ec65ff819aa2fc6fae9b22706bcef40b1818ca8546a5a6ff7
SHA512a5b9b9a12b8046355a6eaf43db7f725a91c0d9da1260cf10f6abf2b3719c7b3796a3ca02d6f8baad9a372e2a7107dfaae74cb204cf25ff3a15ca730427d2b8b7
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Filesize192B
MD5a770069787069fb8157fefc91ddf6b29
SHA18b5f2aa52057a4bd634ef320a142c180ba5100ee
SHA2569637d44d3d51112ce7f829b44bb3c249d3bad0c1810112d7d3725784eaf99372
SHA512acbd4d0e199519edb04ad57ba3779db68c678b129648473ddcae04372aa67ace66f7c0cad1db80eb70d1ad68a0344dbbabaa3d529e37fe1d9f4f38d191b608ba
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize410B
MD5694d53e9c89c7733e141e948abd16784
SHA1bd3927cab8906c35c11bfc83ebe97c26a64f8ed0
SHA256f7ba941a823db5485dfc42c846c9ce802a27f2a3cbba841a4a0f41630b287afd
SHA512bb0415707ce9bf824e37f243a4f1f4505f0e001dda4537b664ca26054d6fb8d5695b73611510a24e72c8b90997cf26a7a96f158023a592b79c6050fd0b674bed
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_DE183C8BD2F85F62C6D4E33AB37362F1
Filesize414B
MD5b8121b280798c500a6848b780e2391db
SHA13e7d0c972495db799ccd5c7c3e0d78665fe01d1d
SHA25627c8ebe67cc2e124857849cb9153dd2864396ce9e5c586bee64d4de2ef5abc3e
SHA512ba180aa964c3633e194edc09d529d5c309191bb50641b424e3398951ad0f08d412f046db44ae5b5dd840e0d777039d3176d402e93ee0eaf2f6d1fa0afd933d3b
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\4A804121E5D59A1E36CA0C5C4DA67985
Filesize552B
MD5b77df88b4e71d9e2f694d9e101c903ba
SHA164825af2143c4ae5bf2dfdeb62a18d4185c54f17
SHA256f065040c79c74eb2cedbb82642dca6f5a8a999e90c9c8e69e9a82f5e9df34d81
SHA512458d8e5776982b8959a76b3e7119910887b914d21e604fef94b4390e18fd37efec24d3f79373d7609bcf55aaa88bc4be97f3b61ed128e06a2b08f11968b4d586
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
Filesize438B
MD51055efb1563f5b4901a6140356532c71
SHA11dfae03779f7faf554838cbaa586a6156915218f
SHA256ae5491150f5a5153ec24010afb3b509208d4a5073091b1b45e255dea432a619e
SHA512257a625203edfaf3014c8730a4edce51b4eb3523054908ec571b93e5432ea75c765f34d3ecc5290991fbd7fd21bbb6d156b1a7db786449ddcda12749a3f2445d
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_A373FEC5204D779A8604E28CC627A508
Filesize518B
MD542f12c4e9bc0420db89d0e8e74ccdc46
SHA1747c953cab816ece6947cbd88eed9288209e3c61
SHA2560ec7840ee0560f25acee0f899dc9c57a9e42dae011b7e05f9dd2de328a0b581a
SHA5128d5bd86ef93c0742880e3d758bc7ec35afa5c9b0a228eed86ed5adb04a9692abb417dea562c59b3c2fdfb238979aa8711a5d065bc6df3795c07575e08462b9d6
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
Filesize482B
MD5a4ffdad5016e55b4d03f1353cc7b89e6
SHA1d13313f67e9f0581d19a347a3d0828fb436725c5
SHA25688dcb7090bb6c49a28ecf0f4b25438e82217e88f9a23d151c7e906c345b4d2c9
SHA51272ad22a19ab576cfe8b8ae1375c603d573d3cb30d58c9b3e0feceb782185fa59cbf898804be937c355dd16e26fc6e42b9aa952004be9924fa0099b4036dc44af
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
Filesize400B
MD5a77e533d6cf96501f40e457cdc1bf834
SHA1ca3b42fa84683c388f70093d1e747507b74a5c50
SHA256db98143bedaf41076dc70cf2af1fd5a06b47d581eabf81d6e055d0472fed028f
SHA512325c0f083dc23f7e697bef6fc81cf0cf2ccce47e74af4f0fa7b1ce31b1c216210f7ccc1932198d00591f25529ef1006fb3c9b359059e71ae9d27723dc743e8a0
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize392B
MD501986bed8985325745122ca27e832de3
SHA161d9870f1cacbdbe4435e39c04f123ba12c5107c
SHA25629ac5fa4d7012b840b03eadbb20d7498613225aee3516c737af40ec405a2ee4d
SHA51248c918a24ae18001b198d254d110cdaa7c43a4d8693cb0d5b6ba9f1b151836d486c7e610aff6be70c75cbfb18a5ba94a50ffbca1e869feefcde05cdab1bd5590
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_613BDE957D3B3963FB2B4F46E11452DB
Filesize402B
MD52d1043785d135ecf8dd2d43fbb4fa2de
SHA19e36ed85b6dd611608bead265c959e7905b6587f
SHA2568b3342c3bcb6e88161a2240a459ed1e88e2cc739761c305332b800f1284af2d2
SHA5122bcfda74ed138d5206dd7895c8c2641f221f9c0da01b095175c8f0884366679b5207a106279a6cc3a7888622747c5df0d46dd02685173af7ec6ec56ad189e731
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_0B931C13A5AA79B672090C0D1D0A52BE
Filesize406B
MD59a5a4f0c8cc6e7765e50f1467a549f71
SHA191a1ea7e93a0968d55598308d581ba8d21692afb
SHA2566c602935ed98c7c241b29a1b0b7e6da5b2af1e90b64774188e231fdfccf050e7
SHA512dca3311fdd59760c5bc72e35344ac6edef01b654ddff23839acf1e70695da136e9baa7a92c73cc1d66d46fcf6f2da476193d094b7ede6ef6c16df638e224b328
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\Windows\3720402701\2219095117.pri
Filesize207KB
MD5e2b88765ee31470114e866d939a8f2c6
SHA1e0a53b8511186ff308a0507b6304fb16cabd4e1f
SHA256523e419d2fa2e780239812d36caa37e92f8c3e6a5cd9f18f0d807c593effa45e
SHA512462e8e6b4e63fc6781b6a9935b332a1dc77bfb88e1de49134f86fd46bd1598d2e842902dd9415a328e325bd7cdee766bd9473f2695acdfa769ffe7ba9ae1953d
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\HFESDE7A\favicon[1].ico
Filesize5KB
MD5f3418a443e7d841097c714d69ec4bcb8
SHA149263695f6b0cdd72f45cf1b775e660fdc36c606
SHA2566da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770
SHA51282d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\UFBNMNZG\favicon[1].ico
Filesize66KB
MD572c17e495a03f0940f5086e9f1f1ff69
SHA122fdf73909c7f001a99cc5765ba4b084549aa334
SHA2561a21d4c284833e91d97f6044a42a020b7ccba44cbbe9b58cf9fdd2db8e4f680e
SHA512bbb723d9f3cf47dbb2a8e1de9c91db07640f7bd17b5a4ae30579329755b118d9b7291281e1fc6a5093fe1dfb5ad5f64e5d9f5a981f0d04c4d6c6b4719dace26b
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\LogFiles\edb.log
Filesize512KB
MD5383111a915206e0cdbc003c3e54619c4
SHA1a2dc85c6be90a601d08779f4f1ca39fe2ae705f1
SHA2567b8e58a6a31e00d8f28c4bca719fc12bb696deb80d5c7fb102de1019440513f9
SHA5123e6035e47511270bb13719f0f939d5fa063157a59697f34671d071b36b3a6b95a6f6a1e549c45c5c77843fcdb45acec17aed36e4ac79ff69d275ecea16d195c3
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\edb.chk
Filesize8KB
MD5429530a5516d10b6509f146ee42841d8
SHA1017740e300be25c74095e1a4885d224f137aad8c
SHA25647cbda7f26f52b645c8b1c365944eaaa5cc1c666b3c1d8e2716096b0d1574021
SHA512ce46b15eaa84d71106cd61c6629ad9e65cc1b90005a1292073808562a1188fc8e14d60dfc9d15f468297cbeca2660036ef0b80b0028b9e15fc072baf94997f09
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\spartan.edb
Filesize2.0MB
MD59648356a2629341476dffb33713240bb
SHA14df70e6a070a940cac4b9a00b91a926546dc1909
SHA256dcf363d07bd8aa204f422933a397e7a284e8ddc3cf367d1a32e1ca1b4cfe7ff6
SHA512c40c7bdd199ac5cc53bbc6d184f53a86136781694e06ac75f38e1a619258d840b8c4703321f347b9b379118f2f743924aadfa315436253d6c6f80b6dce7224e4
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\spartan.jfm
Filesize16KB
MD52545423ba30fd95c02db0b5d735fdca3
SHA1c7df8ee4f15628200bafc85c66cacc4ccb351935
SHA256717854e00619efcd44ad65d8728796471e4110ca5628b7f098d34f80dc422f82
SHA512adf29d9eab90c103128f5395b62bd4009cd9b546c1b4b68a01ff3527a858b36f791239d0f1dd3b36848c892f5da6549c3b244d2d152462ee46ebb3e85dc19bd1
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\ImageStore\ku6lwtv\imagestore.dat
Filesize173KB
MD50f0e4c0f997b890f9db0ba1fb6260872
SHA129c4a242380282f1f5c6abdb6a0c33d380fca1c9
SHA2566f65d3194e0c7c2d888f652c647181b66f2473be2f0f81afcd1b01cc522b5e68
SHA512c1186a9c09393359c1f9e83b16a52456d3d039a41697621e486db7698de2773fdaf84140f0bfee869215c4cbc0bd5e7ff633b50a512f328e43df920cb0074119
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\Recovery\Active\RecoveryStore.{209E58C2-86C1-4416-BDE5-067158313B92}.dat
Filesize4KB
MD5ec517e784b8f8d6a77e338153555e8a2
SHA144c1843a0f9eef13620de1c36eb952ada859ef4e
SHA25698f79cad7d0c032c0632e8e32ce590a3efea873e4d32dcdfec4af3c75ee41398
SHA5121abc7360aeebc0221ebd3392a97c592850f150bf1e521149daf40cda4ba07b55a7527c229cfeed4f0da0819804135ae21637d38b68df5119fc35b399158960cd
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\Recovery\Active\{5A54D138-D533-497B-B0F0-DB6B1030BE31}.dat
Filesize31KB
MD52c2376c0d431fd12aec0dc3aff3eeef1
SHA15c0ca9fd0385f2a6a24a3d1a97b0cb876c9523e8
SHA25690049b7811b4c0cd1d19035ae997becc674c31b165256bd1dbc103d197e38e4c
SHA512a148d3e7f33ab3a21f4e2069197e77e43744aefdef5d6bfbf9c0985a37ca981a05d1d2a4d5cb31a8b19ae6797c250f7d00e22bc3c8072fc17775deb501637261
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\Recovery\Active\{A036BFCC-C5DE-452D-9D21-BD360EE1F89F}.dat
Filesize29KB
MD58d46d2f99ffe353c757de567b71d49ba
SHA17ecfd0f4c17fc65b60560fa19ecff21e3513f1c3
SHA256f6234d4a3cca52409b026ff0173539baa7483934ea80660ed65f76ecbdd55f4b
SHA5124efb8482b24f216b5ff34ddc2613279309e40f5789611380e06f45778752d31c56ce713a386b824a875846632addf0b460ebac916cf25f6ffe1fc58d58822c4e
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\Microsoft\Windows\3720402701\2219095117.pri
Filesize207KB
MD5e2b88765ee31470114e866d939a8f2c6
SHA1e0a53b8511186ff308a0507b6304fb16cabd4e1f
SHA256523e419d2fa2e780239812d36caa37e92f8c3e6a5cd9f18f0d807c593effa45e
SHA512462e8e6b4e63fc6781b6a9935b332a1dc77bfb88e1de49134f86fd46bd1598d2e842902dd9415a328e325bd7cdee766bd9473f2695acdfa769ffe7ba9ae1953d