Windows Analysis Report
PdfConverters.exe

Overview

General Information

Sample name: PdfConverters.exe
Analysis ID: 1432408
MD5: 74b6039660be3eda726a4eee209679ba
SHA1: 407df21d8452462957a235266e808818d0f8ce53
SHA256: 3ddfa37d2779149114bfdd3e56efd6573426628639cc6d7e180aa8f15a85c5a2
Infos:

Detection

Score: 45
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Multi AV Scanner detection for submitted file
Found strings related to Crypto-Mining
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Drops PE files
Enables debug privileges
Found dropped PE file which has not been started or loaded
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains sections with non-standard names
PE file does not import any functions
Queries keyboard layouts
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Stores files to the Windows start menu directory
Uses 32bit PE files
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

AV Detection
barindex
Antivirus detection for URL or domain
Source: https://www.pdfconvertercompare.com/main/u Avira URL Cloud: Label: malware
Source: https://discovery.lenovo.com.cn/home062291 Avira URL Cloud: Label: phishing
Multi AV Scanner detection for submitted file
Source: PdfConverters.exe ReversingLabs: Detection: 31%

Bitcoin Miner
barindex
Found strings related to Crypto-Mining
Source: msedgewebview2.exe, 00000007.00000002.2574845002.00002C0000C0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: jsecoin.com/
Source: msedgewebview2.exe, 00000007.00000002.2574845002.00002C0000C0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: coinhive.com/
Uses 32bit PE files
Source: PdfConverters.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: PdfConverters.exe Static PE information: certificate valid
Source: unknown HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown HTTPS traffic detected: 23.51.58.94:443 -> 192.168.2.5:49728 version: TLS 1.2
Source: unknown HTTPS traffic detected: 23.51.58.94:443 -> 192.168.2.5:49729 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.126.24.149:443 -> 192.168.2.5:49734 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.126.24.149:443 -> 192.168.2.5:49736 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.126.24.149:443 -> 192.168.2.5:49736 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.5:49758 version: TLS 1.2
Source: PdfConverters.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: Binary string: System.Threading.pdb source: PdfConverters.exe, 00000000.00000002.2458725706.000000006B1E2000.00000020.00000001.01000000.00000014.sdmp, System.Threading.dll.0.dr
Source: Binary string: /_/artifacts/obj/System.Windows.Forms/Release/netcoreapp3.1/System.Windows.Forms.pdbSHA256 source: PdfConverters.exe, 00000000.00000002.2459166964.000000006B6DD000.00000020.00000001.01000000.0000000E.sdmp
Source: Binary string: System.Data.pdb source: PdfConverters.exe
Source: Binary string: System.ComponentModel.ni.pdb source: PdfConverters.exe
Source: Binary string: System.IO.FileSystem.DriveInfo.ni.pdbRSDS source: PdfConverters.exe
Source: Binary string: System.IO.FileSystem.DriveInfo.ni.pdb source: PdfConverters.exe
Source: Binary string: System.Diagnostics.Process.ni.pdbRSDS source: PdfConverters.exe
Source: Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: api-ms-win-core-sysinfo-l1-1-0.dll.0.dr
Source: Binary string: System.Drawing.Common.ni.pdb source: PdfConverters.exe, 00000000.00000002.2457159749.000000006B024000.00000020.00000001.01000000.0000001B.sdmp
Source: Binary string: System.IO.FileSystem.Watcher.pdb source: PdfConverters.exe
Source: Binary string: System.IO.Compression.Brotli.pdb source: PdfConverters.exe
Source: Binary string: System.Linq.Expressions.ni.pdbRSDS source: PdfConverters.exe
Source: Binary string: System.Diagnostics.Tools.pdb source: PdfConverters.exe
Source: Binary string: System.Globalization.pdb source: PdfConverters.exe
Source: Binary string: System.ComponentModel.EventBasedAsync.pdb source: PdfConverters.exe
Source: Binary string: System.IO.MemoryMappedFiles.ni.pdb source: PdfConverters.exe
Source: Binary string: System.Data.DataSetExtensions.pdb@/runtimes/win-x86/lib/netcoreapp3.1/System.Data.DataSetExtensions.dll source: PdfConverters.exe
Source: Binary string: Microsoft.VisualBasic.pdb source: PdfConverters.exe
Source: Binary string: System.IO.Compression.ZipFile.pdb0lruntimes/win-x86/lib/netcoreapp3.1/System.IO.Compression.ZipFile.dll source: PdfConverters.exe, System.IO.Compression.ZipFile.dll.0.dr
Source: Binary string: System.ComponentModel.Annotations.ni.pdbRSDSq source: PdfConverters.exe
Source: Binary string: D:\a\_work\1\s\third_party\edge_webview2\win\winforms_control\Microsoft.Web.WebView2.WinForms\obj\release\netcoreapp3.0\Microsoft.Web.WebView2.WinForms.pdb source: PdfConverters.exe, 00000000.00000002.2451093235.0000000007CE2000.00000002.00000001.01000000.0000001F.sdmp
Source: Binary string: System.Xml.XmlSerializer.ni.pdb source: System.Xml.XmlSerializer.dll.0.dr
Source: Binary string: System.Globalization.Extensions.pdb 0runtimes/win-x86/lib/netcoreapp3.1/System.Globalization.Extensions.dll source: PdfConverters.exe
Source: Binary string: System.IO.ni.pdbRSDS source: PdfConverters.exe
Source: Binary string: System.Runtime.Serialization.Primitives.ni.pdbRSDS source: System.Runtime.Serialization.Primitives.dll.0.dr
Source: Binary string: System.ComponentModel.EventBasedAsync.ni.pdb source: PdfConverters.exe
Source: Binary string: D:\a\_work\e\src\out\Release\WebView2Loader.dll.pdb source: PdfConverters.exe
Source: Binary string: System.ComponentModel.pdbD2runtimes/win-x86/lib/netcoreapp3.1/System.ComponentModel.dll source: PdfConverters.exe
Source: Binary string: D:\a\_work\1\s\bin\obj\Windows_NT.x86.Release\src\dlls\mscorrc\full\Release\mscorrc.debug.pdb source: PdfConverters.exe, 00000000.00000002.2453358482.0000000009E30000.00000002.00000001.00040000.00000035.sdmp
Source: Binary string: System.Xml.XmlSerializer.pdbX9runtimes/win-x86/lib/netcoreapp3.1/System.Xml.XmlSerializer.dll source: System.Xml.XmlSerializer.dll.0.dr
Source: Binary string: System.Memory.pdb source: PdfConverters.exe, 00000000.00000002.2458498219.000000006B1B2000.00000020.00000001.01000000.00000015.sdmp
Source: Binary string: System.Diagnostics.TraceSource.pdbH source: PdfConverters.exe
Source: Binary string: System.ComponentModel.Annotations.pdb@ source: PdfConverters.exe
Source: Binary string: D:\a\_work\1\s\bin\obj\Windows_NT.x86.Release\src\jit\standalone\Release\clrjit.pdb source: PdfConverters.exe, 00000000.00000002.2475798115.000000006BF1F000.00000002.00000001.01000000.0000000B.sdmp
Source: Binary string: System.Threading.Thread.pdb source: PdfConverters.exe, 00000000.00000002.2456830161.000000006B002000.00000020.00000001.01000000.0000001D.sdmp
Source: Binary string: System.Diagnostics.FileVersionInfo.ni.pdb source: PdfConverters.exe
Source: Binary string: System.Buffers.ni.pdb source: PdfConverters.exe, System.Buffers.dll.0.dr
Source: Binary string: System.Collections.pdb source: PdfConverters.exe
Source: Binary string: System.Collections.Specialized.ni.pdb source: PdfConverters.exe
Source: Binary string: /_/artifacts/obj/System.Drawing.Common/netcoreapp3.0-Windows_NT-Release/System.Drawing.Common.pdb source: PdfConverters.exe, 00000000.00000002.2457159749.000000006B024000.00000020.00000001.01000000.0000001B.sdmp
Source: Binary string: System.Diagnostics.DiagnosticSource.ni.pdbRSDSM source: PdfConverters.exe
Source: Binary string: System.IO.UnmanagedMemoryStream.ni.pdb source: PdfConverters.exe
Source: Binary string: Microsoft.VisualBasic.Core.ni.pdbRSDS source: PdfConverters.exe
Source: Binary string: Microsoft.VisualBasic.ni.pdb source: PdfConverters.exe
Source: Binary string: System.ComponentModel.DataAnnotations.pdb source: PdfConverters.exe
Source: Binary string: System.IO.MemoryMappedFiles.pdb source: PdfConverters.exe
Source: Binary string: PresentationFramework.Aero.ni.pdbRSDS source: PresentationFramework.Aero.dll.0.dr
Source: Binary string: System.Runtime.Serialization.Primitives.ni.pdb source: System.Runtime.Serialization.Primitives.dll.0.dr
Source: Binary string: System.Reflection.TypeExtensions.ni.pdbRSDS] source: System.Reflection.TypeExtensions.dll.0.dr
Source: Binary string: System.Diagnostics.Tools.ni.pdb source: PdfConverters.exe
Source: Binary string: System.Buffers.pdbx/runtimes/win-x86/lib/netcoreapp3.1/System.Buffers.dll source: PdfConverters.exe, System.Buffers.dll.0.dr
Source: Binary string: System.Reflection.TypeExtensions.ni.pdb source: System.Reflection.TypeExtensions.dll.0.dr
Source: Binary string: /_/artifacts/obj/Microsoft.Win32.SystemEvents/netcoreapp3.0-Windows_NT-Release/Microsoft.Win32.SystemEvents.pdb source: PdfConverters.exe, 00000000.00000002.2455761226.000000006AC92000.00000020.00000001.01000000.00000028.sdmp
Source: Binary string: miutils.pdbGCTL source: miutils.dll.0.dr
Source: Binary string: System.Data.DataSetExtensions.ni.pdbRSDS source: PdfConverters.exe
Source: Binary string: System.Private.CoreLib.ni.pdbRSDS source: PdfConverters.exe, 00000000.00000002.2477313553.000000006BF65000.00000020.00000001.01000000.0000000A.sdmp
Source: Binary string: System.Threading.Tasks.pdb source: PdfConverters.exe, 00000000.00000002.2455544252.000000006AC72000.00000020.00000001.01000000.0000002A.sdmp
Source: Binary string: System.IO.Compression.pdb source: PdfConverters.exe
Source: Binary string: /_/artifacts/obj/System.Security.Cryptography.Xml/netstandard-Release/System.Security.Cryptography.Xml.pdb source: System.Security.Cryptography.Xml.dll.0.dr
Source: Binary string: System.Console.pdb source: PdfConverters.exe
Source: Binary string: System.IO.Compression.ZipFile.ni.pdbRSDSAc source: PdfConverters.exe, System.IO.Compression.ZipFile.dll.0.dr
Source: Binary string: System.Drawing.Primitives.pdb source: PdfConverters.exe
Source: Binary string: System.ComponentModel.DataAnnotations.ni.pdbRSDSb. source: PdfConverters.exe
Source: Binary string: mscorlib.pdb source: PdfConverters.exe, 00000000.00000002.2451837571.0000000007E92000.00000002.00000001.01000000.00000021.sdmp
Source: Binary string: api-ms-win-crt-process-l1-1-0.pdb source: api-ms-win-crt-process-l1-1-0.dll.0.dr
Source: Binary string: System.IO.Compression.Brotli.pdbp source: PdfConverters.exe
Source: Binary string: System.Threading.ni.pdb source: PdfConverters.exe, 00000000.00000002.2458725706.000000006B1E2000.00000020.00000001.01000000.00000014.sdmp, System.Threading.dll.0.dr
Source: Binary string: System.IO.Compression.Brotli.ni.pdbRSDSzHs source: PdfConverters.exe
Source: Binary string: System.Collections.NonGeneric.ni.pdbRSDS source: PdfConverters.exe
Source: Binary string: System.Threading.Tasks.Parallel.ni.pdb source: System.Threading.Tasks.Parallel.dll.0.dr
Source: Binary string: System.Runtime.Extensions.ni.pdbRSDS source: PdfConverters.exe, 00000000.00000002.2457838985.000000006B112000.00000020.00000001.01000000.00000019.sdmp
Source: Binary string: System.ComponentModel.TypeConverter.pdb source: PdfConverters.exe
Source: Binary string: System.Diagnostics.TextWriterTraceListener.ni.pdbRSDS G |#c source: PdfConverters.exe, System.Diagnostics.TextWriterTraceListener.dll.0.dr
Source: Binary string: System.Diagnostics.Tracing.ni.pdb source: PdfConverters.exe, System.Diagnostics.Tracing.dll.0.dr
Source: Binary string: System.ComponentModel.DataAnnotations.ni.pdb source: PdfConverters.exe
Source: Binary string: System.Globalization.Calendars.pdb source: PdfConverters.exe
Source: Binary string: System.Runtime.Serialization.pdb source: System.Runtime.Serialization.dll.0.dr
Source: Binary string: PresentationFramework.Aero.ni.pdb source: PresentationFramework.Aero.dll.0.dr
Source: Binary string: System.Configuration.ni.pdbRSDS source: PdfConverters.exe, System.Configuration.dll.0.dr
Source: Binary string: System.Diagnostics.StackTrace.pdbTuruntimes/win-x86/lib/netcoreapp3.1/System.Diagnostics.StackTrace.dll source: PdfConverters.exe
Source: Binary string: System.Drawing.Primitives.ni.pdb source: PdfConverters.exe
Source: Binary string: System.Buffers.pdb source: PdfConverters.exe, System.Buffers.dll.0.dr
Source: Binary string: System.ComponentModel.Annotations.pdb source: PdfConverters.exe
Source: Binary string: System.ComponentModel.Annotations.ni.pdb source: PdfConverters.exe
Source: Binary string: Accessibility.ni.pdb source: PdfConverters.exe, 00000000.00000002.2456745883.000000006AFF2000.00000020.00000001.01000000.0000001E.sdmp, Accessibility.dll.0.dr
Source: Binary string: System.Drawing.Primitives.ni.pdbRSDS source: PdfConverters.exe
Source: Binary string: System.Collections.Concurrent.ni.pdb source: PdfConverters.exe
Source: Binary string: System.Runtime.pdb source: PdfConverters.exe, 00000000.00000002.2482519360.000000006F802000.00000020.00000001.01000000.0000000D.sdmp
Source: Binary string: System.ComponentModel.Primitives.ni.pdb source: PdfConverters.exe, System.ComponentModel.Primitives.dll.0.dr
Source: Binary string: /_/artifacts/obj/PresentationFramework.Aero/Release/netcoreapp3.1/PresentationFramework.Aero.pdb,^ source: PresentationFramework.Aero.dll.0.dr
Source: Binary string: System.Reflection.Emit.Lightweight.ni.pdbRSDS& source: System.Reflection.Emit.Lightweight.dll.0.dr
Source: Binary string: Microsoft.VisualBasic.Core.ni.pdb source: PdfConverters.exe
Source: Binary string: System.Diagnostics.StackTrace.ni.pdbRSDSq source: PdfConverters.exe
Source: Binary string: System.IO.Compression.ZipFile.ni.pdb source: PdfConverters.exe, System.IO.Compression.ZipFile.dll.0.dr
Source: Binary string: Microsoft.Win32.Primitives.ni.pdbRSDSR$=iA source: PdfConverters.exe
Source: Binary string: Microsoft.CSharp.ni.pdbRSDSz source: PdfConverters.exe
Source: Binary string: System.Collections.Immutable.pdb7 source: PdfConverters.exe
Source: Binary string: System.Core.ni.pdb source: PdfConverters.exe
Source: Binary string: Accessibility.ni.pdb\Eruntimes/win-x86/lib/netcoreapp3.1/Accessibility.dll source: PdfConverters.exe, 00000000.00000002.2456745883.000000006AFF2000.00000020.00000001.01000000.0000001E.sdmp, Accessibility.dll.0.dr
Source: Binary string: System.Private.Uri.ni.pdbRSDS source: PdfConverters.exe, 00000000.00000002.2456220158.000000006ACF2000.00000020.00000001.01000000.00000025.sdmp
Source: Binary string: System.Diagnostics.Tracing.pdb<2runtimes/win-x86/lib/netcoreapp3.1/System.Diagnostics.Tracing.dll source: PdfConverters.exe, System.Diagnostics.Tracing.dll.0.dr
Source: Binary string: System.IO.MemoryMappedFiles.ni.pdbRSDS source: PdfConverters.exe
Source: Binary string: System.ComponentModel.EventBasedAsync.ni.pdbRSDS source: PdfConverters.exe
Source: Binary string: System.Linq.Expressions.ni.pdb source: PdfConverters.exe
Source: Binary string: System.Diagnostics.Debug.ni.pdbRSDS source: PdfConverters.exe
Source: Binary string: System.Buffers.ni.pdbRSDS source: PdfConverters.exe, System.Buffers.dll.0.dr
Source: Binary string: System.Diagnostics.TraceSource.pdb source: PdfConverters.exe
Source: Binary string: System.Memory.ni.pdb source: PdfConverters.exe, 00000000.00000002.2458498219.000000006B1B2000.00000020.00000001.01000000.00000015.sdmp
Source: Binary string: System.Security.Cryptography.Algorithms.ni.pdb source: System.Security.Cryptography.Algorithms.dll.0.dr
Source: Binary string: System.IO.Pipes.ni.pdb source: PdfConverters.exe
Source: Binary string: System.Threading.Tasks.Parallel.pdbk source: System.Threading.Tasks.Parallel.dll.0.dr
Source: Binary string: System.Threading.Thread.ni.pdb source: PdfConverters.exe, 00000000.00000002.2456830161.000000006B002000.00000020.00000001.01000000.0000001D.sdmp
Source: Binary string: System.Text.Encodings.Web.ni.pdbRSDS source: System.Text.Encodings.Web.dll.0.dr
Source: Binary string: D:\a\_work\1\s\artifacts\obj\win-x86.Release\corehost\cli\hostpolicy\Release\hostpolicy.pdb source: PdfConverters.exe, 00000000.00000002.2481678010.000000006CC1D000.00000002.00000001.01000000.00000008.sdmp
Source: Binary string: System.Diagnostics.FileVersionInfo.ni.pdbRSDSX source: PdfConverters.exe
Source: Binary string: /_/artifacts/obj/System.Windows.Forms/Release/netcoreapp3.1/System.Windows.Forms.pdb source: PdfConverters.exe, 00000000.00000002.2459166964.000000006B6DD000.00000020.00000001.01000000.0000000E.sdmp
Source: Binary string: System.IO.ni.pdb source: PdfConverters.exe
Source: Binary string: System.Runtime.Serialization.ni.pdb source: System.Runtime.Serialization.dll.0.dr
Source: Binary string: System.ComponentModel.ni.pdbRSDS source: PdfConverters.exe
Source: Binary string: System.Configuration.pdb<?runtimes/win-x86/lib/netcoreapp3.1/System.Configuration.dll source: PdfConverters.exe, System.Configuration.dll.0.dr
Source: Binary string: System.Runtime.InteropServices.ni.pdb source: PdfConverters.exe, 00000000.00000002.2482126842.000000006E5A2000.00000020.00000001.01000000.00000012.sdmp, System.Runtime.InteropServices.dll.0.dr
Source: Binary string: System.Runtime.ni.pdbRSDS source: PdfConverters.exe, 00000000.00000002.2482519360.000000006F802000.00000020.00000001.01000000.0000000D.sdmp
Source: Binary string: System.Memory.ni.pdbRSDS source: PdfConverters.exe, 00000000.00000002.2458498219.000000006B1B2000.00000020.00000001.01000000.00000015.sdmp
Source: Binary string: System.Globalization.Calendars.ni.pdbRSDS[)k7#|#E source: PdfConverters.exe
Source: Binary string: System.IO.Pipes.AccessControl.ni.pdb source: PdfConverters.exe
Source: Binary string: System.Diagnostics.Contracts.ni.pdb source: PdfConverters.exe
Source: Binary string: System.Configuration.ni.pdb source: PdfConverters.exe, System.Configuration.dll.0.dr
Source: Binary string: System.IO.FileSystem.ni.pdbRSDSh source: PdfConverters.exe
Source: Binary string: System.Console.ni.pdbRSDS2 source: PdfConverters.exe
Source: Binary string: System.Collections.Immutable.ni.pdbRSDSwDA-C source: PdfConverters.exe
Source: Binary string: api-ms-win-crt-math-l1-1-0.pdb source: api-ms-win-crt-math-l1-1-0.dll.0.dr
Source: Binary string: System.Diagnostics.FileVersionInfo.pdb@_runtimes/win-x86/lib/netcoreapp3.1/System.Diagnostics.FileVersionInfo.dll source: PdfConverters.exe
Source: Binary string: System.Threading.Tasks.ni.pdbRSDS source: PdfConverters.exe, 00000000.00000002.2455544252.000000006AC72000.00000020.00000001.01000000.0000002A.sdmp
Source: Binary string: System.Runtime.InteropServices.RuntimeInformation.ni.pdbRSDS source: System.Runtime.InteropServices.RuntimeInformation.dll.0.dr
Source: Binary string: System.Memory.pdb<h source: PdfConverters.exe, 00000000.00000002.2458498219.000000006B1B2000.00000020.00000001.01000000.00000015.sdmp
Source: Binary string: System.Console.ni.pdb source: PdfConverters.exe
Source: Binary string: System.Diagnostics.Contracts.pdb source: PdfConverters.exe
Source: Binary string: System.IO.FileSystem.AccessControl.ni.pdbRSDS source: PdfConverters.exe
Source: Binary string: System.IO.FileSystem.ni.pdb source: PdfConverters.exe
Source: Binary string: System.IO.IsolatedStorage.pdb source: PdfConverters.exe
Source: Binary string: System.Collections.Specialized.ni.pdbRSDS source: PdfConverters.exe
Source: Binary string: System.IO.FileSystem.AccessControl.ni.pdb source: PdfConverters.exe
Source: Binary string: System.IO.FileSystem.Primitives.pdb source: PdfConverters.exe
Source: Binary string: System.IO.IsolatedStorage.ni.pdbRSDS source: PdfConverters.exe
Source: Binary string: System.Data.Common.ni.pdbRSDS source: PdfConverters.exe
Source: Binary string: System.Globalization.Extensions.ni.pdb source: PdfConverters.exe
Source: Binary string: System.Drawing.Common.ni.pdbRSDS source: PdfConverters.exe, 00000000.00000002.2457159749.000000006B024000.00000020.00000001.01000000.0000001B.sdmp
Source: Binary string: System.Collections.NonGeneric.pdb source: PdfConverters.exe
Source: Binary string: System.Collections.Immutable.pdb source: PdfConverters.exe
Source: Binary string: D:\a\_work\1\s\artifacts\obj\win-x86.Release\corehost\cli\apphost\Release\apphost.pdbiii source: PdfConverters.exe
Source: Binary string: System.Diagnostics.StackTrace.ni.pdb source: PdfConverters.exe
Source: Binary string: System.IO.Compression.FileSystem.ni.pdbRSDS source: PdfConverters.exe
Source: Binary string: System.ni.pdb source: PdfConverters.exe, 00000000.00000002.2455456821.000000006AC62000.00000020.00000001.01000000.0000002B.sdmp
Source: Binary string: System.ComponentModel.pdb source: PdfConverters.exe
Source: Binary string: System.Core.ni.pdbRSDS source: PdfConverters.exe
Source: Binary string: D:\a\_work\1\s\bin\obj\Windows_NT.x86.Release\src\dlls\mscoree\coreclr\Release\coreclr.pdb source: PdfConverters.exe, 00000000.00000002.2481308828.000000006CAF6000.00000002.00000001.01000000.00000009.sdmp
Source: Binary string: Microsoft.Win32.Primitives.ni.pdb source: PdfConverters.exe
Source: Binary string: System.Runtime.Serialization.ni.pdbRSDS source: System.Runtime.Serialization.dll.0.dr
Source: Binary string: System.ComponentModel.Primitives.pdb source: PdfConverters.exe, System.ComponentModel.Primitives.dll.0.dr
Source: Binary string: System.Resources.ResourceManager.ni.pdb source: System.Resources.ResourceManager.dll.0.dr
Source: Binary string: System.Diagnostics.TextWriterTraceListener.pdb source: PdfConverters.exe, System.Diagnostics.TextWriterTraceListener.dll.0.dr
Source: Binary string: System.IO.IsolatedStorage.pdb source: PdfConverters.exe
Source: Binary string: /_/artifacts/obj/PresentationFramework.Aero/Release/netcoreapp3.1/PresentationFramework.Aero.pdb source: PresentationFramework.Aero.dll.0.dr
Source: Binary string: System.IO.Pipes.ni.pdbRSDS\rEv source: PdfConverters.exe
Source: Binary string: Microsoft.VisualBasic.pdb`7runtimes/win-x86/lib/netcoreapp3.1/Microsoft.VisualBasic.dll source: PdfConverters.exe
Source: Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: api-ms-win-crt-filesystem-l1-1-0.dll.0.dr
Source: Binary string: Microsoft.Win32.Registry.ni.pdb source: PdfConverters.exe
Source: Binary string: System.IO.Pipes.AccessControl.ni.pdbRSDS source: PdfConverters.exe
Source: Binary string: System.IO.FileSystem.AccessControl.pdb source: PdfConverters.exe
Source: Binary string: System.IO.pdb source: PdfConverters.exe
Source: Binary string: System.Reflection.Emit.Lightweight.ni.pdb source: System.Reflection.Emit.Lightweight.dll.0.dr
Source: Binary string: System.IO.Compression.Brotli.ni.pdb source: PdfConverters.exe
Source: Binary string: api-ms-win-core-heap-l1-1-0.pdb source: api-ms-win-core-heap-l1-1-0.dll.0.dr
Source: Binary string: D:\a\_work\1\s\artifacts\obj\win-x86.Release\corehost\cli\apphost\Release\apphost.pdb source: PdfConverters.exe
Source: Binary string: System.IO.FileSystem.pdb source: PdfConverters.exe
Source: Binary string: System.Diagnostics.Tracing.ni.pdbRSDSu3 source: PdfConverters.exe, System.Diagnostics.Tracing.dll.0.dr
Source: Binary string: System.Diagnostics.Process.pdb source: PdfConverters.exe
Source: Binary string: System.Collections.Specialized.pdb source: PdfConverters.exe
Source: Binary string: System.Diagnostics.TextWriterTraceListener.ni.pdb source: PdfConverters.exe, System.Diagnostics.TextWriterTraceListener.dll.0.dr
Source: Binary string: System.Diagnostics.Tools.ni.pdbRSDS source: PdfConverters.exe
Source: Binary string: System.Runtime.InteropServices.pdbX source: PdfConverters.exe, 00000000.00000002.2482126842.000000006E5A2000.00000020.00000001.01000000.00000012.sdmp, System.Runtime.InteropServices.dll.0.dr
Source: Binary string: System.AppContext.pdb source: PdfConverters.exe
Source: Binary string: System.Collections.ni.pdb source: PdfConverters.exe
Source: Binary string: System.Private.CoreLib.ni.pdb source: PdfConverters.exe, 00000000.00000002.2477313553.000000006BF65000.00000020.00000001.01000000.0000000A.sdmp
Source: Binary string: System.Diagnostics.TraceSource.ni.pdbRSDS source: PdfConverters.exe
Source: Binary string: D:\a\_work\1\s\third_party\edge_webview2\win\winforms_control\Microsoft.Web.WebView2.WinForms\obj\release\netcoreapp3.0\Microsoft.Web.WebView2.WinForms.pdb@ source: PdfConverters.exe, 00000000.00000002.2451093235.0000000007CE2000.00000002.00000001.01000000.0000001F.sdmp
Source: Binary string: System.Threading.Tasks.ni.pdb source: PdfConverters.exe, 00000000.00000002.2455544252.000000006AC72000.00000020.00000001.01000000.0000002A.sdmp
Source: Binary string: System.IO.UnmanagedMemoryStream.ni.pdbRSDS source: PdfConverters.exe
Source: Binary string: System.IO.pdbt/runtimes/win-x86/lib/netcoreapp3.1/System.IO.dll source: PdfConverters.exe
Source: Binary string: System.Runtime.Serialization.Primitives.pdb source: System.Runtime.Serialization.Primitives.dll.0.dr
Source: Binary string: System.Diagnostics.Contracts.ni.pdbRSDS source: PdfConverters.exe
Source: Binary string: System.Console.pdbP source: PdfConverters.exe
Source: Binary string: Microsoft.CSharp.pdb source: PdfConverters.exe
Source: Binary string: System.Reflection.Emit.Lightweight.pdb source: System.Reflection.Emit.Lightweight.dll.0.dr
Source: Binary string: D:\a\_work\1\s\artifacts\obj\win-x86.Release\corehost\cli\fxr\Release\hostfxr.pdbxxx source: PdfConverters.exe, 00000000.00000002.2481848156.000000006E18E000.00000002.00000001.01000000.00000007.sdmp
Source: Binary string: System.Globalization.Extensions.pdb source: PdfConverters.exe
Source: Binary string: System.Threading.Tasks.Parallel.ni.pdbRSDS source: System.Threading.Tasks.Parallel.dll.0.dr
Source: Binary string: Microsoft.VisualBasic.ni.pdbRSDS# source: PdfConverters.exe
Source: Binary string: System.Configuration.pdb source: PdfConverters.exe, System.Configuration.dll.0.dr
Source: Binary string: System.Data.ni.pdb source: PdfConverters.exe
Source: Binary string: api-ms-win-core-localization-l1-2-0.pdb source: api-ms-win-core-localization-l1-2-0.dll.0.dr
Source: Binary string: System.Threading.Tasks.pdbp4runtimes/win-x86/lib/netcoreapp3.1/System.Threading.Tasks.dll source: PdfConverters.exe, 00000000.00000002.2455544252.000000006AC72000.00000020.00000001.01000000.0000002A.sdmp
Source: Binary string: System.ComponentModel.Primitives.ni.pdbRSDS source: PdfConverters.exe, System.ComponentModel.Primitives.dll.0.dr
Source: Binary string: System.Runtime.Extensions.ni.pdb source: PdfConverters.exe, 00000000.00000002.2457838985.000000006B112000.00000020.00000001.01000000.00000019.sdmp
Source: Binary string: System.Collections.Immutable.ni.pdb source: PdfConverters.exe
Source: Binary string: /_/artifacts/obj/System.Security.Cryptography.ProtectedData/netstandard-Windows_NT-Release/System.Security.Cryptography.ProtectedData.pdbSHA256E\ source: System.Security.Cryptography.ProtectedData.dll.0.dr
Source: Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: api-ms-win-core-processthreads-l1-1-1.dll.0.dr
Source: Binary string: System.IO.UnmanagedMemoryStream.pdb source: PdfConverters.exe
Source: Binary string: D:\a\_work\1\s\third_party\edge_webview2\win\webview2_api_writer\dotNetAPIWrapper\Microsoft.Web.WebView2.Core\bin\ReleasePackage\Microsoft.Web.WebView2.Core.pdb source: PdfConverters.exe, 00000000.00000002.2451625945.0000000007E12000.00000002.00000001.01000000.00000020.sdmp
Source: Binary string: /_/artifacts/obj/System.Drawing.Facade/Release/netcoreapp3.1/System.Drawing.pdb source: PdfConverters.exe, 00000000.00000002.2456367745.000000006AF42000.00000020.00000001.01000000.00000023.sdmp
Source: Binary string: api-ms-win-crt-multibyte-l1-1-0.pdb source: api-ms-win-crt-multibyte-l1-1-0.dll.0.dr
Source: Binary string: System.AppContext.ni.pdb source: PdfConverters.exe
Source: Binary string: System.Diagnostics.DiagnosticSource.ni.pdb source: PdfConverters.exe
Source: Binary string: System.IO.Compression.ni.pdbRSDS source: PdfConverters.exe
Source: Binary string: System.Security.Cryptography.Xml.ni.pdbRSDS source: System.Security.Cryptography.Xml.dll.0.dr
Source: Binary string: Microsoft.Win32.Primitives.pdb source: PdfConverters.exe
Source: Binary string: System.Data.DataSetExtensions.pdb source: PdfConverters.exe
Source: Binary string: System.Dynamic.Runtime.pdb source: PdfConverters.exe, System.Dynamic.Runtime.dll.0.dr
Source: Binary string: Microsoft.Win32.Registry.pdb source: PdfConverters.exe
Source: Binary string: System.Security.Cryptography.Xml.ni.pdb source: System.Security.Cryptography.Xml.dll.0.dr
Source: Binary string: System.Data.DataSetExtensions.ni.pdb source: PdfConverters.exe
Source: Binary string: System.Collections.Concurrent.ni.pdbRSDS source: PdfConverters.exe
Source: Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: api-ms-win-core-interlocked-l1-1-0.dll.0.dr
Source: Binary string: System.Globalization.ni.pdbRSDS source: PdfConverters.exe
Source: Binary string: System.ComponentModel.TypeConverter.pdb,&runtimes/win-x86/lib/netcoreapp3.1/System.ComponentModel.TypeConverter.dll source: PdfConverters.exe
Source: Binary string: Microsoft.CSharp.ni.pdb source: PdfConverters.exe
Source: Binary string: Microsoft.Win32.Registry.pdbX source: PdfConverters.exe
Source: Binary string: System.Text.Encodings.Web.ni.pdb source: System.Text.Encodings.Web.dll.0.dr
Source: Binary string: System.Collections.ni.pdbRSDS source: PdfConverters.exe
Source: Binary string: System.Runtime.ni.pdb source: PdfConverters.exe, 00000000.00000002.2482519360.000000006F802000.00000020.00000001.01000000.0000000D.sdmp
Source: Binary string: System.Reflection.TypeExtensions.pdb source: System.Reflection.TypeExtensions.dll.0.dr
Source: Binary string: System.Security.Cryptography.Algorithms.ni.pdbRSDS source: System.Security.Cryptography.Algorithms.dll.0.dr
Source: Binary string: System.Diagnostics.TraceSource.ni.pdb source: PdfConverters.exe
Source: Binary string: System.IO.Compression.FileSystem.ni.pdb source: PdfConverters.exe
Source: Binary string: System.Data.Common.pdb source: PdfConverters.exe
Source: Binary string: System.Runtime.InteropServices.pdb source: PdfConverters.exe, 00000000.00000002.2482126842.000000006E5A2000.00000020.00000001.01000000.00000012.sdmp, System.Runtime.InteropServices.dll.0.dr
Source: Binary string: System.Diagnostics.Process.ni.pdb source: PdfConverters.exe
Source: Binary string: System.Windows.Forms.ni.pdb source: PdfConverters.exe, 00000000.00000002.2459166964.000000006B6DD000.00000020.00000001.01000000.0000000E.sdmp
Source: Binary string: System.Runtime.InteropServices.RuntimeInformation.pdb source: System.Runtime.InteropServices.RuntimeInformation.dll.0.dr
Source: Binary string: System.Private.Uri.ni.pdb source: PdfConverters.exe, 00000000.00000002.2456220158.000000006ACF2000.00000020.00000001.01000000.00000025.sdmp
Source: Binary string: System.Drawing.ni.pdb source: PdfConverters.exe, 00000000.00000002.2456367745.000000006AF42000.00000020.00000001.01000000.00000023.sdmp
Source: Binary string: System.AppContext.ni.pdbRSDS source: PdfConverters.exe
Source: Binary string: System.IO.Pipes.pdb source: PdfConverters.exe
Source: Binary string: System.IO.FileSystem.Primitives.ni.pdb source: PdfConverters.exe
Source: Binary string: System.Drawing.ni.pdbRSDS source: PdfConverters.exe, 00000000.00000002.2456367745.000000006AF42000.00000020.00000001.01000000.00000023.sdmp
Source: Binary string: System.Runtime.pdb| source: PdfConverters.exe, 00000000.00000002.2482519360.000000006F802000.00000020.00000001.01000000.0000000D.sdmp
Source: Binary string: System.Runtime.InteropServices.ni.pdbRSDS` source: PdfConverters.exe, 00000000.00000002.2482126842.000000006E5A2000.00000020.00000001.01000000.00000012.sdmp, System.Runtime.InteropServices.dll.0.dr
Source: Binary string: System.Dynamic.Runtime.ni.pdbRSDS source: PdfConverters.exe, System.Dynamic.Runtime.dll.0.dr
Source: Binary string: System.Text.Encodings.Web.pdb source: System.Text.Encodings.Web.dll.0.dr
Source: Binary string: api-ms-win-core-util-l1-1-0.pdb source: api-ms-win-core-util-l1-1-0.dll.0.dr
Source: Binary string: System.Collections.NonGeneric.ni.pdb source: PdfConverters.exe
Source: Binary string: System.Diagnostics.Debug.pdb source: PdfConverters.exe
Source: Binary string: System.Diagnostics.DiagnosticSource.pdb source: PdfConverters.exe
Source: Binary string: System.Windows.Forms.ni.pdbRSDS source: PdfConverters.exe, 00000000.00000002.2459166964.000000006B6DD000.00000020.00000001.01000000.0000000E.sdmp
Source: Binary string: System.Resources.ResourceManager.ni.pdbRSDS source: System.Resources.ResourceManager.dll.0.dr
Source: Binary string: System.Linq.Expressions.pdb source: PdfConverters.exe
Source: Binary string: System.Globalization.Extensions.ni.pdbRSDS^ source: PdfConverters.exe
Source: Binary string: D:\a\_work\1\s\artifacts\obj\win-x86.Release\corehost\cli\hostpolicy\Release\hostpolicy.pdbvvv source: PdfConverters.exe, 00000000.00000002.2481678010.000000006CC1D000.00000002.00000001.01000000.00000008.sdmp
Source: Binary string: /_/artifacts/obj/System.Security.Cryptography.ProtectedData/netstandard-Windows_NT-Release/System.Security.Cryptography.ProtectedData.pdb source: System.Security.Cryptography.ProtectedData.dll.0.dr
Source: Binary string: System.Private.CoreLib.pdbD[ source: PdfConverters.exe, 00000000.00000002.2477313553.000000006BF65000.00000020.00000001.01000000.0000000A.sdmp
Source: Binary string: System.Collections.Concurrent.pdb source: PdfConverters.exe
Source: Binary string: System.IO.Compression.ni.pdb source: PdfConverters.exe
Source: Binary string: System.IO.Compression.FileSystem.pdb<.runtimes/win-x86/lib/netcoreapp3.1/System.IO.Compression.FileSystem.dll source: PdfConverters.exe
Source: Binary string: System.Diagnostics.Tracing.pdb source: PdfConverters.exe, System.Diagnostics.Tracing.dll.0.dr
Source: Binary string: System.Resources.ResourceManager.pdb<0runtimes/win-x86/lib/netcoreapp3.1/System.Resources.ResourceManager.dll source: System.Resources.ResourceManager.dll.0.dr
Source: Binary string: System.ComponentModel.TypeConverter.ni.pdb source: PdfConverters.exe
Source: Binary string: D:\a\_work\1\s\artifacts\obj\win-x86.Release\corehost\cli\fxr\Release\hostfxr.pdb source: PdfConverters.exe, 00000000.00000002.2481848156.000000006E18E000.00000002.00000001.01000000.00000007.sdmp
Source: Binary string: System.IO.IsolatedStorage.ni.pdb source: PdfConverters.exe
Source: Binary string: System.Threading.Tasks.Parallel.pdb source: System.Threading.Tasks.Parallel.dll.0.dr
Source: Binary string: System.Threading.ni.pdbRSDSHV source: PdfConverters.exe, 00000000.00000002.2458725706.000000006B1E2000.00000020.00000001.01000000.00000014.sdmp, System.Threading.dll.0.dr
Source: Binary string: System.ni.pdbRSDS source: PdfConverters.exe, 00000000.00000002.2455456821.000000006AC62000.00000020.00000001.01000000.0000002B.sdmp
Source: Binary string: System.Runtime.Extensions.pdb source: PdfConverters.exe, 00000000.00000002.2457838985.000000006B112000.00000020.00000001.01000000.00000019.sdmp
Source: Binary string: System.Diagnostics.Debug.ni.pdb source: PdfConverters.exe
Source: Binary string: System.Private.CoreLib.pdb source: PdfConverters.exe, 00000000.00000002.2477313553.000000006BF65000.00000020.00000001.01000000.0000000A.sdmp
Source: Binary string: Microsoft.Win32.Registry.ni.pdbRSDSA source: PdfConverters.exe
Source: Binary string: /_/artifacts/obj/System.Drawing.Common/netcoreapp3.0-Windows_NT-Release/System.Drawing.Common.pdbSHA256 source: PdfConverters.exe, 00000000.00000002.2457159749.000000006B024000.00000020.00000001.01000000.0000001B.sdmp
Source: Binary string: Microsoft.Win32.SystemEvents.ni.pdb source: PdfConverters.exe, 00000000.00000002.2455761226.000000006AC92000.00000020.00000001.01000000.00000028.sdmp
Source: Binary string: System.Resources.ResourceManager.pdb source: System.Resources.ResourceManager.dll.0.dr
Source: Binary string: System.Xml.XmlSerializer.pdb source: System.Xml.XmlSerializer.dll.0.dr
Source: Binary string: /_/artifacts/obj/System.Security.Cryptography.Xml/netstandard-Release/System.Security.Cryptography.Xml.pdbSHA256 source: System.Security.Cryptography.Xml.dll.0.dr
Source: Binary string: System.IO.FileSystem.DriveInfo.pdb source: PdfConverters.exe
Source: Binary string: System.Security.Cryptography.Algorithms.pdb source: System.Security.Cryptography.Algorithms.dll.0.dr
Source: Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: api-ms-win-crt-conio-l1-1-0.dll.0.dr
Source: Binary string: System.Globalization.ni.pdb source: PdfConverters.exe
Source: Binary string: System.IO.FileSystem.Primitives.ni.pdbRSDS source: PdfConverters.exe
Source: Binary string: System.Runtime.InteropServices.RuntimeInformation.ni.pdb source: System.Runtime.InteropServices.RuntimeInformation.dll.0.dr
Source: Binary string: System.pdb source: PdfConverters.exe, 00000000.00000002.2455456821.000000006AC62000.00000020.00000001.01000000.0000002B.sdmp
Source: Binary string: System.IO.FileSystem.Watcher.ni.pdbRSDS% source: PdfConverters.exe
Source: Binary string: System.Globalization.Calendars.ni.pdb source: PdfConverters.exe
Source: Binary string: System.IO.FileSystem.Watcher.ni.pdb source: PdfConverters.exe
Source: Binary string: /_/artifacts/obj/Microsoft.Win32.SystemEvents/netcoreapp3.0-Windows_NT-Release/Microsoft.Win32.SystemEvents.pdbSHA256 source: PdfConverters.exe, 00000000.00000002.2455761226.000000006AC92000.00000020.00000001.01000000.00000028.sdmp
Source: Binary string: miutils.pdb source: miutils.dll.0.dr
Source: Binary string: System.ComponentModel.TypeConverter.ni.pdbRSDS source: PdfConverters.exe
Source: Binary string: System.Security.Cryptography.ProtectedData.ni.pdb source: System.Security.Cryptography.ProtectedData.dll.0.dr
Source: Binary string: System.IO.Compression.ZipFile.pdb source: PdfConverters.exe, System.IO.Compression.ZipFile.dll.0.dr
Source: Binary string: System.Dynamic.Runtime.ni.pdb source: PdfConverters.exe, System.Dynamic.Runtime.dll.0.dr
Source: Binary string: System.Core.pdb source: PdfConverters.exe
Source: Binary string: System.IO.Pipes.AccessControl.pdb source: PdfConverters.exe
Source: Binary string: System.Collections.pdb,E source: PdfConverters.exe
Source: Binary string: Microsoft.Win32.SystemEvents.ni.pdbRSDS source: PdfConverters.exe, 00000000.00000002.2455761226.000000006AC92000.00000020.00000001.01000000.00000028.sdmp
Source: Binary string: System.Diagnostics.StackTrace.pdb source: PdfConverters.exe
Source: Binary string: System.Data.Common.ni.pdb source: PdfConverters.exe
Source: Binary string: System.Security.Cryptography.ProtectedData.ni.pdbRSDSE\ source: System.Security.Cryptography.ProtectedData.dll.0.dr
Source: Binary string: System.Threading.Thread.ni.pdbRSDS source: PdfConverters.exe, 00000000.00000002.2456830161.000000006B002000.00000020.00000001.01000000.0000001D.sdmp
Source: Binary string: System.IO.Compression.FileSystem.pdb source: PdfConverters.exe
Source: Binary string: Microsoft.VisualBasic.Core.pdb source: PdfConverters.exe
Source: Binary string: System.Diagnostics.FileVersionInfo.pdb source: PdfConverters.exe
Source: Binary string: System.Private.Uri.pdb source: PdfConverters.exe, 00000000.00000002.2456220158.000000006ACF2000.00000020.00000001.01000000.00000025.sdmp
Source: Binary string: System.Data.ni.pdbRSDS! source: PdfConverters.exe
Source: Binary string: D:\a\_work\1\s\third_party\edge_webview2\win\webview2_api_writer\dotNetAPIWrapper\Microsoft.Web.WebView2.Core\bin\ReleasePackage\Microsoft.Web.WebView2.Core.pdb@% source: PdfConverters.exe, 00000000.00000002.2451625945.0000000007E12000.00000002.00000001.01000000.00000020.sdmp
Source: Binary string: System.Xml.XmlSerializer.ni.pdbRSDS source: System.Xml.XmlSerializer.dll.0.dr
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe File opened: C:\Users\user\AppData\Local\ Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe File opened: C:\Users\user\AppData\ Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe File opened: C:\Users\user\AppData\Local\Temp\PdfConverters.WebView2\EBWebView\Default\Local Storage\leveldb\ Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe File opened: C:\Users\user\ Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe File opened: C:\Users\user\AppData\Local\Temp\PdfConverters.WebView2\EBWebView\ Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe File opened: C:\Users\user\AppData\Local\Temp\PdfConverters.WebView2\EBWebView\Default\Local Storage\ Jump to behavior
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 162.159.61.3 162.159.61.3
Source: Joe Sandbox View IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View IP Address: 172.64.41.3 172.64.41.3
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.24.149
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.24.149
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.24.149
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.24.149
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.24.149
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.24.149
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.24.149
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.24.149
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.24.149
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.24.149
Source: global traffic HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=RXNTczoNfp9++f2&MD=n4ky1MkT HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fhl%3Den-US%26async%3Dfixed:0&hl=en-US&q=EgSaEMC5GIDlsLEGIjDG6Hc-ezWC0mnp0AyytLwVv-kUFYEWMWMpW589K61ZukyZsieLnYau-G9p8nS8MNkyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-04-26-23; NID=513=gQE88cBbBu_IdhwTI8m7X_rC4d_lhvkZVKaENpWtfxcS4-Nqv0sNzq4UQ2mSp1A4nXGAIx3keGaL-RO64xwfYhakmAAtKxzDhE2HR4DoOi_jsL4c8upvCaNKWNcLsnGXZdSSjvBEqgsB0OKVxMTN6I0OI4pT7pnwOiGVm6jIZA4
Source: global traffic HTTP traffic detected: GET /sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgSaEMC5GIDlsLEGIjBxPpOaYoxhB3SX16WS72QdfGyEzR8PwkmWY5QiXp9fQCDjhH34KJzsLeYewFPjoYMyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-04-26-23; NID=513=SwN5PdFwBQ9GO7fxfOwswsVdzB05GsF2y0ra9uhs1hRCPYVaRfbpJk470ZiWWNwf0IWbc6IllXEQNeCYfYTo3M1aZwQDAhQTox63sLRHAKfQm0hAp673LKZtBJWAmQ1IpMnv_7ixfKsyqAFgfqLNJEPrwUHtpLfAbka1l8Mv0hs
Source: global traffic HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic HTTP traffic detected: GET /main HTTP/1.1Host: www.pdfconvertercompare.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.pdfconvertercompare.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.pdfconvertercompare.com/mainAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=RXNTczoNfp9++f2&MD=n4ky1MkT HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: msedgewebview2.exe, 0000000C.00000002.2455885401.000066C000898000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000000C.00000003.2440350378.000066C000898000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://microsoftstart.msn.cn/*https://rewards.microsoft.com/*https://www.microsoftnews.com/*https://www.facebook.com/*www.staging-bing-int.comaction.getBadgeTextColorhttps://outlook.live.com/*https://rewards.bing.com/*https://www.microsoftnews.cn/*translatorserp.bing.comhttps://translator.bing.com/* equals www.facebook.com (Facebook)
Source: msedgewebview2.exe, 00000007.00000002.2571003459.00002C0000464000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000000C.00000002.2455885401.000066C000898000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000000C.00000003.2440350378.000066C000898000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.facebook.com/* equals www.facebook.com (Facebook)
Source: msedgewebview2.exe, 00000007.00000002.2567998965.00002C0000054000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000000C.00000002.2452564393.000066C0002A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: global traffic DNS traffic detected: DNS query: www.pdfconvertercompare.com
Source: global traffic DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: unknown HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://129fy.ie.chalai.net
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://360kjedge.dh.softby.cn
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://360kjedge.xrccp.com
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://430360cs.yc.anhuang.net
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://511sllqdkj.yc.anhuang.net
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://511zdqdkj.yc.anhuang.net
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://608hyestn.yc.ceg29.com
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://625mressw.yc.ceg29.com
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://803hyescs.30bz.com
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://aldkj207.dh.softby.cn
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://aldkj827.xrccp.com
Source: msedgewebview2.exe, 00000007.00000002.2573649634.00002C00008C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433732946.0000462400178000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433595120.0000462400158000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433698737.0000462400168000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/1423136
Source: msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/1423136edS
Source: msedgewebview2.exe, 00000007.00000002.2571652767.00002C00005CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433732946.0000462400178000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2162
Source: msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000002.2567773098.00002C0000020000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555797776.0000462400228000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433732946.0000462400178000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2517
Source: msedgewebview2.exe, 00000007.00000002.2570352947.00002C0000394000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433732946.0000462400178000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433698737.0000462400168000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2970
Source: msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000002.2571652767.00002C00005CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433732946.0000462400178000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3078
Source: msedgewebview2.exe, 00000007.00000003.2546344223.00002C0000390000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000002.2570352947.00002C0000394000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433732946.0000462400178000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433698737.0000462400168000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3205
Source: msedgewebview2.exe, 00000007.00000002.2573649634.00002C00008C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000002.2567773098.00002C0000020000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555797776.0000462400228000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3206
Source: msedgewebview2.exe, 00000007.00000003.2546344223.00002C0000390000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000002.2570352947.00002C0000394000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433732946.0000462400178000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3452
Source: msedgewebview2.exe, 00000007.00000002.2572661049.00002C0000770000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433732946.0000462400178000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433698737.0000462400168000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3498
Source: msedgewebview2.exe, 00000007.00000003.2546344223.00002C0000390000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000002.2570352947.00002C0000394000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433732946.0000462400178000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3502
Source: msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000002.2567773098.00002C0000020000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433732946.0000462400178000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3577
Source: msedgewebview2.exe, 00000007.00000002.2573649634.00002C00008C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555797776.0000462400228000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3584
Source: msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433698737.0000462400168000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3586
Source: msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3623
Source: msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3624
Source: msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3625
Source: msedgewebview2.exe, 00000009.00000002.2554109258.0000462400098000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3625F$
Source: msedgewebview2.exe, 00000007.00000002.2573649634.00002C00008C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555797776.0000462400228000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3832
Source: msedgewebview2.exe, 00000007.00000002.2573649634.00002C00008C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555797776.0000462400228000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3862
Source: msedgewebview2.exe, 00000007.00000002.2573649634.00002C00008C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3862v
Source: msedgewebview2.exe, 00000007.00000002.2573649634.00002C00008C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555797776.0000462400228000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3965
Source: msedgewebview2.exe, 00000007.00000003.2546344223.00002C0000390000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000002.2570352947.00002C0000394000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000002.2567773098.00002C0000020000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433732946.0000462400178000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433698737.0000462400168000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3970
Source: msedgewebview2.exe, 00000007.00000002.2573602095.00002C00008A0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433732946.0000462400178000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433698737.0000462400168000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4324
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433732946.0000462400178000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433698737.0000462400168000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4384
Source: msedgewebview2.exe, 00000007.00000002.2573649634.00002C00008C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555797776.0000462400228000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4405
Source: msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000002.2567773098.00002C0000020000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433732946.0000462400178000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4428
Source: msedgewebview2.exe, 00000007.00000002.2567773098.00002C0000020000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/44283&
Source: msedgewebview2.exe, 00000007.00000002.2573649634.00002C00008C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000002.2573602095.00002C00008A0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555797776.0000462400228000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433732946.0000462400178000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433698737.0000462400168000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4551
Source: msedgewebview2.exe, 00000007.00000002.2571652767.00002C00005CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433732946.0000462400178000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4633
Source: msedgewebview2.exe, 00000007.00000002.2570352947.00002C0000394000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433732946.0000462400178000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433698737.0000462400168000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4722
Source: msedgewebview2.exe, 00000007.00000002.2573649634.00002C00008C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000002.2567773098.00002C0000020000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555797776.0000462400228000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433732946.0000462400178000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4836
Source: msedgewebview2.exe, 00000007.00000002.2570352947.00002C0000394000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433732946.0000462400178000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433698737.0000462400168000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4901
Source: msedgewebview2.exe, 00000007.00000002.2570352947.00002C0000394000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433732946.0000462400178000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4937
Source: msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000002.2567773098.00002C0000020000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433732946.0000462400178000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433595120.0000462400158000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433698737.0000462400168000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5007
Source: msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5007yH
Source: msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5055
Source: msedgewebview2.exe, 00000007.00000002.2575637125.00002C0000D50000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555797776.0000462400228000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5061
Source: msedgewebview2.exe, 00000007.00000002.2573649634.00002C00008C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555797776.0000462400228000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5281
Source: msedgewebview2.exe, 00000007.00000002.2573649634.00002C00008C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555797776.0000462400228000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5371
Source: msedgewebview2.exe, 00000007.00000003.2546344223.00002C0000390000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000002.2570352947.00002C0000394000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433732946.0000462400178000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5375
Source: msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000002.2567773098.00002C0000020000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433732946.0000462400178000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5421
Source: msedgewebview2.exe, 00000007.00000002.2573649634.00002C00008C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555797776.0000462400228000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5430
Source: msedgewebview2.exe, 00000007.00000003.2546344223.00002C0000390000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000002.2570352947.00002C0000394000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433732946.0000462400178000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433698737.0000462400168000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5535
Source: msedgewebview2.exe, 00000007.00000002.2573649634.00002C00008C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433732946.0000462400178000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433698737.0000462400168000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5658
Source: msedgewebview2.exe, 00000007.00000002.2573649634.00002C00008C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433732946.0000462400178000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433698737.0000462400168000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5750
Source: msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5750)$F#
Source: msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5750ty
Source: msedgewebview2.exe, 00000007.00000002.2573649634.00002C00008C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000002.2575637125.00002C0000D50000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555797776.0000462400228000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5881
Source: msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000002.2567773098.00002C0000020000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433732946.0000462400178000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5901
Source: msedgewebview2.exe, 00000007.00000002.2573649634.00002C00008C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000002.2567773098.00002C0000020000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555797776.0000462400228000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433732946.0000462400178000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5906
Source: msedgewebview2.exe, 00000009.00000002.2555797776.0000462400228000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5906F$
Source: msedgewebview2.exe, 00000007.00000002.2573649634.00002C00008C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5906a
Source: msedgewebview2.exe, 00000007.00000002.2573649634.00002C00008C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5906hhK
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433732946.0000462400178000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433698737.0000462400168000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6041
Source: msedgewebview2.exe, 00000007.00000002.2573649634.00002C00008C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555797776.0000462400228000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6048
Source: msedgewebview2.exe, 00000007.00000002.2573649634.00002C00008C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555797776.0000462400228000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6141
Source: msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000002.2567773098.00002C0000020000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555797776.0000462400228000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6248
Source: msedgewebview2.exe, 00000007.00000002.2573649634.00002C00008C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555797776.0000462400228000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6439
Source: msedgewebview2.exe, 00000007.00000003.2546344223.00002C0000390000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000002.2570352947.00002C0000394000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433732946.0000462400178000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6651
Source: msedgewebview2.exe, 00000007.00000002.2573649634.00002C00008C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555797776.0000462400228000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6692
Source: msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433732946.0000462400178000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433698737.0000462400168000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6755
Source: msedgewebview2.exe, 00000007.00000002.2571652767.00002C00005CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433732946.0000462400178000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6860
Source: msedgewebview2.exe, 00000007.00000003.2546344223.00002C0000390000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000002.2570352947.00002C0000394000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433732946.0000462400178000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6876
Source: msedgewebview2.exe, 00000007.00000002.2573649634.00002C00008C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555797776.0000462400228000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6878
Source: msedgewebview2.exe, 00000007.00000002.2570352947.00002C0000394000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433732946.0000462400178000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6929
Source: msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000002.2567773098.00002C0000020000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433732946.0000462400178000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6953
Source: msedgewebview2.exe, 00000007.00000002.2567773098.00002C0000020000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6953k
Source: msedgewebview2.exe, 00000007.00000002.2573649634.00002C00008C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433732946.0000462400178000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433595120.0000462400158000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433698737.0000462400168000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7036
Source: msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7036)
Source: msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7036ides
Source: msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000002.2571652767.00002C00005CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433732946.0000462400178000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7047
Source: msedgewebview2.exe, 00000007.00000002.2567773098.00002C0000020000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555797776.0000462400228000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7172
Source: msedgewebview2.exe, 00000007.00000002.2573649634.00002C00008C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433732946.0000462400178000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433698737.0000462400168000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7279
Source: msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7279)
Source: msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7279p
Source: msedgewebview2.exe, 00000007.00000002.2572661049.00002C0000770000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433732946.0000462400178000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433698737.0000462400168000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7370
Source: msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000002.2571652767.00002C00005CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433732946.0000462400178000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7406
Source: msedgewebview2.exe, 00000007.00000002.2573649634.00002C00008C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555797776.0000462400228000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7488
Source: msedgewebview2.exe, 00000007.00000002.2573649634.00002C00008C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555797776.0000462400228000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7553
Source: msedgewebview2.exe, 00000007.00000002.2573649634.00002C00008C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7553s
Source: msedgewebview2.exe, 00000007.00000002.2573649634.00002C00008C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555797776.0000462400228000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7556
Source: msedgewebview2.exe, 00000007.00000002.2567773098.00002C0000020000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433732946.0000462400178000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433595120.0000462400158000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433698737.0000462400168000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7724
Source: msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7724ancedG
Source: msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7724r
Source: msedgewebview2.exe, 00000007.00000002.2573649634.00002C00008C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433732946.0000462400178000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433595120.0000462400158000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433698737.0000462400168000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7760
Source: msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7760F
Source: msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7760off
Source: msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433698737.0000462400168000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7761
Source: msedgewebview2.exe, 00000007.00000003.2546344223.00002C0000390000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000002.2570352947.00002C0000394000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433732946.0000462400178000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8162
Source: msedgewebview2.exe, 00000007.00000003.2546344223.00002C0000390000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000002.2570352947.00002C0000394000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000002.2567773098.00002C0000020000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555797776.0000462400228000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433732946.0000462400178000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8215
Source: msedgewebview2.exe, 00000007.00000002.2570352947.00002C0000394000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555797776.0000462400228000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433732946.0000462400178000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8229
Source: msedgewebview2.exe, 00000007.00000002.2573649634.00002C00008C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433732946.0000462400178000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433698737.0000462400168000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8280
Source: msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8280F$
Source: msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8280ault
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://bd.gy912.com
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cdmg.yuchiweb.icu
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://click.dotmap.co.kr/?pf_code=
Source: msedgewebview2.exe, 0000000C.00000002.2452450855.000066C00028C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000000C.00000003.2438048494.000066C000694000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000000C.00000003.2438048494.000066C0006AC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000000C.00000003.2438287301.000066C0006AC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crrev.com/c/2555698.
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://df.edge.bdkj.bailiana.com
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://df.edge.qhkj.baicana.com
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://df.edge.zdkj.ker58.com
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://df.zm.zdkj.ker58.com
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://dongtaiwang.com/loc/phome.php?v=
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://dongtaiwang.com/loc/phome.php?v=odo
Source: msedgewebview2.exe, 0000000C.00000002.2448685077.00000211EB612000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://fontfabrik.com
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://game.whwuyan.cn
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://hao123.di178.com/?
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://hao123.di178.com/?r916
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://hao123kjedge.dh.softby.cn
Source: msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2554749351.0000462400108000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555113072.0000462400154000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://issuetracker.google.com/200067929
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://jg.wangamela.com/tg
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mini.yyrtv.com/?from=
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://navi.anhuiyunci.com
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://navi.programmea.com
Source: msedgewebview2.exe, 00000007.00000003.2559069473.00002C0000661000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://pdfconvertercompare.com/main
Source: msedgewebview2.exe, 00000007.00000003.2559069473.00002C0000661000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://pdfconvertercompare.com/main$f
Source: msedgewebview2.exe, 00000007.00000003.2559069473.00002C0000661000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://pdfconvertercompare.com/mainHf
Source: msedgewebview2.exe, 0000000C.00000002.2457110380.000066C00097C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://permanently-removed.invalid/
Source: msedgewebview2.exe, 0000000C.00000002.2452251972.000066C000248000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://permanently-removed.invalid/v1/accountcapabilities:batchGet
Source: msedgewebview2.exe, 0000000C.00000002.2452251972.000066C000248000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://permanently-removed.invalid/v1/accountcapabilities:batchGethttps://permanently-removed.invali
Source: msedgewebview2.exe, 00000007.00000002.2571123797.00002C00004D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://playinfo.gomlab.com/ending_browser.gom?product=GOMPLAYER
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://r.emsoso.cn
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://r.emsoso.cnu
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://r.jgxqebp.cn
Source: msedgewebview2.exe, 00000007.00000003.2559020019.00002C0000E45000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000000A.00000002.2544149651.000056B00036F000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000000A.00000003.2539156149.000056B00035C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://r3.i.lencr.org/0T
Source: msedgewebview2.exe, 00000007.00000003.2559020019.00002C0000E45000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000000A.00000002.2544149651.000056B00036F000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000000A.00000003.2539156149.000056B00035C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://r3.o.lencr.org0
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://service.whchenxiang.com
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://sgcs.edge.ker58.com
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://sgkjedge.47gs.com
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tx.edge.ker58.com
Source: msedgewebview2.exe, 00000007.00000002.2574088065.00002C0000A3C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://unisolated.invalid/
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://vi.liveen.vn/p/home.html
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://web.113989.com/?
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://web.503188.com/?
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.4399.com/flash/32979.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.4399.com/flash/48399.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.4399.com/flash/seer.htm
Source: msedgewebview2.exe, 00000007.00000002.2571652767.00002C00005CC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.chambersign.org1
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.dinoklafbzor.org
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.hao123.com.11818wz.com/?e
Source: msedgewebview2.exe, 00000007.00000002.2565675497.00000260E272E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.pdfconvertercompare.com/main
Source: msedgewebview2.exe, 00000007.00000002.2565675497.00000260E272E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.pdfconvertercompare.com/mainnkn:100;0.010
Source: msedgewebview2.exe, 00000007.00000003.2559020019.00002C0000E45000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000000A.00000002.2544149651.000056B00036F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.c.lencr.org/0
Source: msedgewebview2.exe, 00000007.00000003.2559020019.00002C0000E45000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000000A.00000002.2544149651.000056B00036F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.i.lencr.org/0
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://xt.tiantianbannixue.com
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000002.2568776955.00002C00001AC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://zn728.tdg68.com
Source: msedgewebview2.exe, 00000007.00000003.2537351583.00000260E2755000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://10.0.19045.2006.vb_release
Source: msedgewebview2.exe, 00000007.00000003.2537351583.00000260E2755000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://10.0.19045.2006.vb_releaseoft.c
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://123.sogou.com/?
Source: msedgewebview2.exe, 00000007.00000002.2571003459.00002C0000464000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://17roco.qq.com
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://360.qrfq25sg.xyz
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000002.2568776955.00002C00001AC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://656a.com
Source: msedgewebview2.exe, 0000000A.00000003.2539769380.000056B000148000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://a.nel.cloudflare.com
Source: msedgewebview2.exe, 0000000A.00000002.2543545963.000056B000178000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://a.nel.cloudflare.com/report/v4?s=tUn9Jv1n4WdeAscGeNaNAlIueOTeBeiXfGWADZ9JuvZ%2FLCIajZe5krooR
Source: PdfConverters.exe String found in binary or memory: https://aka.ms/dotnet-core-applaunch?
Source: PdfConverters.exe String found in binary or memory: https://aka.ms/dotnet-core-applaunch?framework=&framework_version=missing_runtime=true&arch=&rid=%c
Source: msedgewebview2.exe, 0000000A.00000002.2542479398.000056B00000C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://alekberg.net/privacy
Source: msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000002.2567773098.00002C0000020000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555797776.0000462400228000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/4830
Source: msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000002.2567773098.00002C0000020000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433732946.0000462400178000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/4966
Source: msedgewebview2.exe, 00000007.00000002.2573649634.00002C00008C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555797776.0000462400228000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/5845
Source: msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000002.2567773098.00002C0000020000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433732946.0000462400178000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/6574
Source: msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000002.2567773098.00002C0000020000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433732946.0000462400178000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7161
Source: msedgewebview2.exe, 00000007.00000002.2567773098.00002C0000020000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7161?
Source: msedgewebview2.exe, 00000007.00000002.2573649634.00002C00008C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555797776.0000462400228000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7162
Source: msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433732946.0000462400178000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433698737.0000462400168000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7246
Source: msedgewebview2.exe, 00000007.00000003.2546344223.00002C0000390000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000002.2570352947.00002C0000394000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433732946.0000462400178000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7308
Source: msedgewebview2.exe, 00000007.00000003.2546344223.00002C0000390000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000002.2570352947.00002C0000394000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7308=
Source: msedgewebview2.exe, 00000007.00000002.2572661049.00002C0000770000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433732946.0000462400178000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433698737.0000462400168000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7319
Source: msedgewebview2.exe, 00000007.00000002.2573649634.00002C00008C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555797776.0000462400228000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7320
Source: msedgewebview2.exe, 00000007.00000002.2573649634.00002C00008C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2546344223.00002C0000390000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000002.2570352947.00002C0000394000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000002.2571652767.00002C00005CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000002.2567773098.00002C0000020000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555797776.0000462400228000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433732946.0000462400178000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7369
Source: msedgewebview2.exe, 00000007.00000002.2571652767.00002C00005CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433732946.0000462400178000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7382
Source: msedgewebview2.exe, 00000007.00000002.2573649634.00002C00008C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555797776.0000462400228000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7489
Source: msedgewebview2.exe, 00000007.00000002.2573649634.00002C00008C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555797776.0000462400228000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7604
Source: msedgewebview2.exe, 00000007.00000002.2573649634.00002C00008C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555797776.0000462400228000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7714
Source: msedgewebview2.exe, 00000007.00000002.2573649634.00002C00008C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555797776.0000462400228000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7847
Source: msedgewebview2.exe, 00000007.00000002.2573649634.00002C00008C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437258005.00002C0000BB0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2437306765.00002C0000D20000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555797776.0000462400228000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001CC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000003.2433780058.00004624001B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7899
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ausu.lol
Source: msedgewebview2.exe, 00000007.00000003.2546344223.00002C0000390000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000002.2570352947.00002C0000394000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://baduk.hangame.com/?utm_source=baduk&utm_medium=icon&utm_campaign=shortcut
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://browser.360.cn/saas/index.html
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://browser.cloud.huawei.com.cn/pc
Source: msedgewebview2.exe, 0000000A.00000002.2543407037.000056B00012C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.cloudflare-dns.com/dns-query
Source: msedgewebview2.exe, 0000000C.00000002.2452333713.000066C000264000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore
Source: msedgewebview2.exe, 0000000C.00000002.2452333713.000066C000264000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromewebstore.google.com/
Source: msedgewebview2.exe, 0000000C.00000002.2452333713.000066C000264000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromewebstore.google.com/6EAED1924DB611B6EEF2A664BD077BE7EAD33B8F4EB74897CB187C7633357C2FE8
Source: msedgewebview2.exe, 00000007.00000002.2575111482.00002C0000CA4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromium-i18n.appspot.com/ssl-aggregate-address/
Source: msedgewebview2.exe, 0000000A.00000002.2542479398.000056B00000C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromium.dns.nextdns.io
Source: msedgewebview2.exe, 0000000A.00000002.2543407037.000056B00012C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cleanbrowsing.org/privacy
Source: msedgewebview2.exe, 0000000C.00000002.2452564393.000066C0002A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://code.51.com
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://daohang.96zxue.com
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://de.withtls.net
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://dev.tg.wan.360.cn/?
Source: msedgewebview2.exe, 0000000A.00000002.2542855349.000056B000088000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/
Source: msedgewebview2.exe, 0000000A.00000002.2542855349.000056B000088000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/V
Source: msedgewebview2.exe, 0000000A.00000002.2542540433.000056B000024000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developers.google.com/speed/public-dns/privacy
Source: msedgewebview2.exe, 0000000A.00000002.2542540433.000056B000024000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developers.google.com/speed/public-dns/privacyquery
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000002.2571479167.00002C0000584000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://discovery.lenovo.com.cn/home
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://discovery.lenovo.com.cn/home062291
Source: msedgewebview2.exe, 0000000A.00000002.2543407037.000056B00012C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://dns.google/dns-query
Source: msedgewebview2.exe, 0000000A.00000002.2543407037.000056B00012C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://dns.levonet.sk/dns-query
Source: msedgewebview2.exe, 0000000A.00000002.2542479398.000056B00000C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://dns.quad9.net/dns-query
Source: msedgewebview2.exe, 0000000A.00000002.2542479398.000056B00000C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://dns.sb/privacy/
Source: msedgewebview2.exe, 0000000A.00000002.2542479398.000056B00000C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://dns.sb/privacy/Char
Source: msedgewebview2.exe, 0000000A.00000002.2543407037.000056B00012C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://dns10.quad9.net/dns-query
Source: msedgewebview2.exe, 0000000A.00000002.2543407037.000056B00012C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://dns11.quad9.net/dns-query
Source: msedgewebview2.exe, 0000000A.00000002.2543407037.000056B00012C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://dns64.dns.google/dns-query
Source: msedgewebview2.exe, 0000000A.00000002.2543407037.000056B00012C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://dnsnl.alekberg.net/dns-query
Source: msedgewebview2.exe, 0000000A.00000002.2543407037.000056B00012C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://doh-01.spectrum.com/dns-query
Source: msedgewebview2.exe, 0000000A.00000002.2543407037.000056B00012C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://doh-02.spectrum.com/dns-query
Source: msedgewebview2.exe, 0000000A.00000002.2542540433.000056B000024000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://doh.cleanbrowsing.org/doh/adult-filter
Source: msedgewebview2.exe, 0000000A.00000002.2542540433.000056B000024000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://doh.cleanbrowsing.org/doh/family-filter
Source: msedgewebview2.exe, 0000000A.00000002.2542540433.000056B000024000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://doh.cleanbrowsing.org/doh/security-filter
Source: msedgewebview2.exe, 0000000A.00000002.2542479398.000056B00000C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://doh.cox.net/dns-query
Source: msedgewebview2.exe, 0000000A.00000002.2543407037.000056B00012C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://doh.dns.sb/dns-query
Source: msedgewebview2.exe, 0000000A.00000002.2542540433.000056B000024000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://doh.familyshield.opendns.com/dns-query
Source: msedgewebview2.exe, 0000000A.00000002.2543407037.000056B00012C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://doh.opendns.com/dns-query
Source: msedgewebview2.exe, 0000000A.00000002.2543407037.000056B00012C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://doh.quickline.ch/dns-query
Source: msedgewebview2.exe, 0000000A.00000002.2543407037.000056B00012C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://doh.xfinity.com/dns-query
Source: msedgewebview2.exe, 0000000C.00000003.2440350378.000066C0008AC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://easyauth.edgebrowser.microsoft-falcon.io/
Source: msedgewebview2.exe, 0000000C.00000003.2440350378.000066C0008AC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://easyauth.edgebrowser.microsoft-staging-falcon.io/
Source: msedgewebview2.exe, 0000000C.00000003.2440350378.000066C0008AC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://easyauth.edgebrowser.microsoft-testing-falcon.io/
Source: msedgewebview2.exe, 00000007.00000002.2572101281.00002C00006D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ecs.nel.measure.office.net?TenantId=Edge&DestinationEndpoint=Edge-Prod-TEB31r4a&FrontEnd=AFD
Source: msedgewebview2.exe, 00000007.00000002.2568776955.00002C00001AC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://edge.ilive.cn
Source: msedgewebview2.exe, 00000007.00000003.2459729647.00000260E2755000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://eu-9.smartscreen
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://gamebox.160.com/static
Source: PresentationFramework.Aero.dll.0.dr String found in binary or memory: https://github.com/dotnet/wpf
Source: PresentationFramework.Aero.dll.0.dr String found in binary or memory: https://github.com/dotnet/wpf4
Source: PdfConverters.exe, 00000000.00000002.2477313553.000000006BF65000.00000020.00000001.01000000.0000000A.sdmp String found in binary or memory: https://github.com/mono/linker/issues/378
Source: msedgewebview2.exe, 0000000C.00000003.2438118769.000066C0006A0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000000C.00000003.2437927431.000066C000834000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000000C.00000003.2438048494.000066C000694000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000000C.00000003.2438048494.000066C0006AC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000000C.00000003.2438287301.000066C0006AC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/6939#issuecomment-1016679588
Source: msedgewebview2.exe, 00000007.00000002.2569060982.00002C00001E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google.com/
Source: msedgewebview2.exe, 00000007.00000002.2569060982.00002C00001E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google.com/lf
Source: msedgewebview2.exe, 00000007.00000002.2571268617.00002C0000518000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://gostop.hangame.com/index.nhn?gameId=msduelgo&utm_source=msduelgo&utm_medium=icon&utm_campaig
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://h5.mcetab.com
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://hao.360.cn/?a1004
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://hao.360.cn/?a1004http://hao123.di178.com/?
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://hao.360.com/?360safe
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://hao.360.com/?a1004
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://hao.360.com/?a1111
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://hao.360.com/?h_lnk
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://hao.360.com/?installer
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://hao.360.com/?src=jsqth
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://hao.360.com/?src=lm&ls=
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://hao.360.com/?wd_xp1
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://hao.360.com/?y1001
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://hao.360.com/?y1002
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://hao.360.com/?y1013
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://hao.lenovo.ilive.cn
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://hao.qq.com/?unc=
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://hao.qq.com/?unc=Af31026&s=o400493_1
Source: msedgewebview2.exe, 00000007.00000002.2571123797.00002C00004D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://hao123-static.cdn.bcebos.com/manual-res/jump_index.html
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://hk.eynbm.com
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://hlj04.com
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://hlj04.comju
Source: msedgewebview2.exe, 0000000C.00000003.2438118769.000066C0006A0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000000C.00000003.2437927431.000066C000834000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000000C.00000003.2438048494.000066C000694000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000000C.00000003.2438048494.000066C0006AC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000000C.00000003.2438287301.000066C0006AC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/C/#the-details-and-summary-elements
Source: msedgewebview2.exe, 0000000C.00000003.2438118769.000066C0006A0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000000C.00000003.2437927431.000066C000834000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000000C.00000003.2438048494.000066C000694000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000000C.00000003.2438048494.000066C0006AC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000000C.00000003.2438287301.000066C0006AC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/rendering.html#flow-content-3
Source: msedgewebview2.exe, 0000000C.00000003.2438118769.000066C0006A0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000000C.00000003.2437927431.000066C000834000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000000C.00000003.2438048494.000066C000694000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000000C.00000003.2438048494.000066C0006AC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000000C.00000003.2438287301.000066C0006AC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/rendering.html#hidden-elements
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ilive.lenovo.com.cn/?f=
Source: msedgewebview2.exe, 00000007.00000002.2571003459.00002C0000464000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000000C.00000002.2456024318.000066C0008BC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000000C.00000002.2452564393.000066C0002A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://int.msn.cn/
Source: msedgewebview2.exe, 00000007.00000002.2571003459.00002C0000464000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000000C.00000002.2456024318.000066C0008BC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000000C.00000002.2452564393.000066C0002A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://int.msn.com/
Source: msedgewebview2.exe, 00000007.00000002.2571003459.00002C0000464000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000000C.00000002.2456024318.000066C0008BC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000000C.00000002.2452564393.000066C0002A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://int1.msn.cn/
Source: msedgewebview2.exe, 00000007.00000002.2571003459.00002C0000464000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000000C.00000002.2456024318.000066C0008BC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000000C.00000002.2452564393.000066C0002A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://int1.msn.com/
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://internet-start.net/?
Source: msedgewebview2.exe, 00000009.00000002.2554749351.0000462400108000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555113072.0000462400154000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/161903006
Source: msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2554749351.0000462400108000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555113072.0000462400154000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/166809097
Source: msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/166809097ure
Source: msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2554749351.0000462400108000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555113072.0000462400154000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/184850002
Source: msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2554749351.0000462400108000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555113072.0000462400154000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/187425444
Source: msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/187425444ys
Source: msedgewebview2.exe, 00000009.00000003.2433698737.0000462400168000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/220069903
Source: msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/220069903ionThumbnail
Source: msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2554749351.0000462400108000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555113072.0000462400154000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/229267970
Source: msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2554749351.0000462400108000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555113072.0000462400154000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/250706693
Source: msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2554749351.0000462400108000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555113072.0000462400154000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/253522366
Source: msedgewebview2.exe, 00000009.00000003.2433698737.0000462400168000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/255411748
Source: msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/2554117480
Source: msedgewebview2.exe, 00000009.00000003.2433757781.0000462400184000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555113072.0000462400154000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/258207403
Source: msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/2582074030
Source: msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555113072.0000462400154000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/274859104
Source: msedgewebview2.exe, 00000009.00000002.2555160725.0000462400190000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2554749351.0000462400108000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2553323172.0000462400038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000009.00000002.2555113072.0000462400154000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/284462263
Source: msedgewebview2.exe, 00000009.00000003.2433698737.0000462400168000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: msedgewebview2.exe, 00000009.00000002.2553237393.0000462400028000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/issues/166475273JG
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://jg.awaliwa.com
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://jianjie.2345.com
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://kf.07073.com
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lenovo.ilive.cn
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lenovo.ilive.cn/?f=
Source: msedgewebview2.exe, 0000000C.00000003.2440350378.000066C000898000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://localhost.msn.com/
Source: msedgewebview2.exe, 00000007.00000003.2436469268.00000260E0884000.00000004.00000020.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000002.2564600814.00000260E0883000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.windows.local
Source: msedgewebview2.exe, 00000007.00000002.2564689180.00000260E08CC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.windows.local/
Source: msedgewebview2.exe, 00000007.00000002.2564689180.00000260E08CC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.windows.localP
Source: msedgewebview2.exe, 00000007.00000002.2568776955.00002C00001AC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lx.pub
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lx.pub/
Source: msedgewebview2.exe, 0000000C.00000003.2440350378.000066C000898000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://microsoftstart.msn.cn/
Source: msedgewebview2.exe, 0000000C.00000002.2453399624.000066C000380000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://microsoftstart.msn.com/
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mini.eastday.com/?qid=04433&rfstyle=qt
Source: msedgewebview2.exe, 00000007.00000002.2569060982.00002C00001E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://msn.cn/
Source: msedgewebview2.exe, 00000007.00000002.2569060982.00002C00001E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://msn.com/
Source: msedgewebview2.exe, 00000007.00000002.2571003459.00002C0000464000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://my.4399.com/yxmsdzls/
Source: msedgewebview2.exe, 00000007.00000002.2571003459.00002C0000464000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://news.4399.com/aoqi/
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://news.4399.com/aoyazhiguang/
Source: msedgewebview2.exe, 00000007.00000002.2571003459.00002C0000464000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://news.4399.com/hxjy/
Source: msedgewebview2.exe, 00000007.00000002.2571003459.00002C0000464000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://news.4399.com/pikatang/
Source: msedgewebview2.exe, 00000007.00000002.2571003459.00002C0000464000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://news.4399.com/qiu/
Source: msedgewebview2.exe, 00000007.00000003.2459729647.00000260E2755000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://newzealand.smartscreen.m10.0.19045.2006.vb_release
Source: msedgewebview2.exe, 0000000A.00000002.2542479398.000056B00000C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://nextdns.io/privacy
Source: msedgewebview2.exe, 0000000A.00000002.2542479398.000056B00000C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://nextdns.io/privacyr
Source: msedgewebview2.exe, 00000007.00000002.2564600814.00000260E0883000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://norway.smartscr
Source: msedgewebview2.exe, 00000007.00000002.2571003459.00002C0000464000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000000C.00000002.2456024318.000066C0008BC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000000C.00000002.2452564393.000066C0002A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ntp.msn.cn/
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: msedgewebview2.exe, 00000007.00000002.2571003459.00002C0000464000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000000C.00000002.2456024318.000066C0008BC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000000C.00000002.2452564393.000066C0002A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ntp.msn.com/
Source: msedgewebview2.exe, 0000000C.00000003.2440350378.000066C000898000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ntp.www.office.com/
Source: msedgewebview2.exe, 0000000A.00000002.2542479398.000056B00000C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://odvr.nic.cz/doh
Source: msedgewebview2.exe, 00000007.00000002.2569060982.00002C00001E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://office.net/
Source: msedgewebview2.exe, 00000007.00000002.2571003459.00002C0000464000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000000C.00000002.2452564393.000066C0002A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://outlook.com/
Source: msedgewebview2.exe, 00000007.00000002.2571003459.00002C0000464000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000000C.00000002.2455885401.000066C000898000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000000C.00000003.2440350378.000066C000898000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://outlook.live.com/
Source: msedgewebview2.exe, 0000000A.00000002.2542955233.000056B0000AC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://pdfconvertercompare.com
Source: msedgewebview2.exe, 00000007.00000002.2572661049.00002C0000770000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2558871996.00002C0000AA0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000002.2574354438.00002C0000AAC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://pdfconvertercompare.com/
Source: msedgewebview2.exe, 0000000C.00000002.2457110380.000066C00097C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/
Source: msedgewebview2.exe, 0000000C.00000002.2457110380.000066C00097C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/AddSession
Source: msedgewebview2.exe, 0000000C.00000002.2452251972.000066C000248000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/GetCheckConnectionInfo
Source: msedgewebview2.exe, 0000000C.00000002.2452251972.000066C000248000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/ListAccounts?json=standard
Source: msedgewebview2.exe, 0000000C.00000002.2457110380.000066C00097C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/Logout
Source: msedgewebview2.exe, 0000000C.00000002.2457110380.000066C00097C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/MergeSession
Source: msedgewebview2.exe, 0000000C.00000002.2457110380.000066C00097C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/OAuthLogin
Source: msedgewebview2.exe, 0000000C.00000002.2457110380.000066C00097C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/RotateBoundCookies
Source: msedgewebview2.exe, 00000007.00000002.2572714847.00002C0000798000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000000C.00000002.2457110380.000066C00097C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/chrome/blank.html
Source: msedgewebview2.exe, 0000000C.00000002.2452251972.000066C000248000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/embedded/reauth/chromeos
Source: msedgewebview2.exe, 0000000C.00000002.2452251972.000066C000248000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/embedded/setup/chrome/usermenu
Source: msedgewebview2.exe, 0000000C.00000002.2452251972.000066C000248000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/embedded/setup/chrome/usermenuhttps://permanently-removed.invali
Source: msedgewebview2.exe, 0000000C.00000002.2452251972.000066C000248000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/embedded/setup/kidsignin/chromeos
Source: msedgewebview2.exe, 0000000C.00000002.2452251972.000066C000248000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/embedded/setup/kidsignup/chromeos
Source: msedgewebview2.exe, 0000000C.00000002.2452251972.000066C000248000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/embedded/setup/v2/chromeos
Source: msedgewebview2.exe, 0000000C.00000002.2452251972.000066C000248000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/embedded/setup/windows
Source: msedgewebview2.exe, 0000000C.00000002.2452251972.000066C000248000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/embedded/xreauth/chrome
Source: msedgewebview2.exe, 0000000C.00000002.2452251972.000066C000248000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/encryption/unlock/desktop
Source: msedgewebview2.exe, 0000000C.00000002.2452564393.000066C0002A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/encryption/unlock/desktop?kdi=CAIaDgoKY2hyb21lc3luYxAB
Source: msedgewebview2.exe, 0000000C.00000002.2452564393.000066C0002A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/encryption/unlock/desktop?kdi=CAIaDgoKY2hyb21lc3luYxABP
Source: msedgewebview2.exe, 0000000C.00000002.2457110380.000066C00097C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/https://permanently-removed.invalid/https://permanently-removed.
Source: msedgewebview2.exe, 0000000C.00000002.2457110380.000066C00097C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/o/oauth2/revoke
Source: msedgewebview2.exe, 0000000C.00000002.2457110380.000066C00097C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/oauth/multilogin
Source: msedgewebview2.exe, 0000000C.00000002.2457110380.000066C00097C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/oauth2/v1/userinfo
Source: msedgewebview2.exe, 0000000C.00000002.2457110380.000066C00097C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/oauth2/v2/tokeninfo
Source: msedgewebview2.exe, 0000000C.00000002.2457110380.000066C00097C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/oauth2/v4/token
Source: msedgewebview2.exe, 0000000C.00000002.2457110380.000066C00097C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/reauth/v1beta/users/
Source: msedgewebview2.exe, 0000000C.00000002.2452251972.000066C000248000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/signin/chrome/sync?ssp=1
Source: msedgewebview2.exe, 0000000C.00000002.2457110380.000066C00097C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/v1/issuetoken
Source: msedgewebview2.exe, 0000000C.00000002.2457110380.000066C00097C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://permanently-removed.invalid/v1/issuetokenhttps://permanently-removed.invalid/reauth/v1beta/u
Source: msedgewebview2.exe, 0000000A.00000002.2542479398.000056B00000C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://public.dns.iij.jp/
Source: msedgewebview2.exe, 0000000A.00000002.2543407037.000056B00012C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://public.dns.iij.jp/dns-query
Source: msedgewebview2.exe, 0000000A.00000002.2542479398.000056B00000C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://public.dns.iij.jp/r
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://redian.mnjunshi.com/?qid=tpnews
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://redian.mnjunshi.com/?qid=tpnewsy_pcuni
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://so.lenovo.com.cn
Source: msedgewebview2.exe, 00000007.00000002.2571003459.00002C0000464000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ssjj.4399.com/
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://start.jword.jp/?fr=slc
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tg.602.com
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tg.602.comu
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tj.xyhvip.cn
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tp.9377s.com
Source: msedgewebview2.exe, 00000007.00000003.2459729647.00000260E2755000.00000004.00000020.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2429949237.00000260E2755000.00000004.00000020.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000002.2565675497.00000260E2731000.00000004.00000020.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000002.2566031541.00000260E2796000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: msedgewebview2.exe, 00000007.00000003.2459729647.00000260E2755000.00000004.00000020.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2429949237.00000260E2755000.00000004.00000020.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000002.2565675497.00000260E2731000.00000004.00000020.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000002.2566031541.00000260E2796000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: msedgewebview2.exe, 00000007.00000003.2459729647.00000260E2755000.00000004.00000020.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2429949237.00000260E2755000.00000004.00000020.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000002.2566031541.00000260E2796000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://web.sogou.com/?
Source: msedgewebview2.exe, 0000000C.00000002.2453399624.000066C000380000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://windows.msn.cn/
Source: msedgewebview2.exe, 0000000C.00000003.2440350378.000066C000898000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://windows.msn.com/
Source: msedgewebview2.exe, 00000007.00000002.2568079600.00002C000008C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.2345.com/?
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/100030_2.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/10305_2.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/10379.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/10379_3.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/107884_3.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/109832_3.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/110975_1.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/112689_3.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/115339_1.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/117227_3.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/117945_4.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/118852_4.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/122099_1.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/12669_4.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/127539_4.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/130389_1.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/130396.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/130396_1.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/132028.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/133630_4.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/134302_2.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/136516_3.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/137116_3.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/137953_4.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/137953_4.htmhttps://www.4399.com/flash/137116_3.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/1382_2.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/145991_4.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/151915_1.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/155283_1.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/155476_2.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/15548_2.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/160944_3.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/163478_3.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/171322_1.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/173634_4.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/177937_3.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/17801_4.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/18012.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/18012_4.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/180977_3.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/18169_2.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/187040_1.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/187228_1.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/188593.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/188739_1.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/189558_3.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/191203_3.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/195673_4.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/195990_1.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/198491_1.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/198637_4.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/198660_4.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/199408_3.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/202061_3.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/202574_2.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/202604_4.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/202692_3.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/202724_3.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/202785.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/202819_3.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/202828_2.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/202901_4.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/202907_2.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/202911_1.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/203018_4.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/203093_4.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/203152.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/203153_4.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/203154.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/203166_2.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/203178_3.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/203215_3.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/203231_4.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/203369_3.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/203371_3.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/203404_2.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/203453_2.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/203476_2.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/203481_3.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/203495_1.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/203515_1.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/203564_4.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/203682_3.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/203768_1.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/204044_4.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/204056_4.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/204206.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/204255_2.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/204290_1.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/204290_1.htmhttps://www.4399.com/flash/204255_2.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/204422_4.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/204429_1.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/204562_3.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/204650_1.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/204685_1.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/204886_3.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/204926_3.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/204952_2.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/204989_4.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/205090_2.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/205147.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/205165.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/205182.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/205235_4.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/205325_2.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/205341_2.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/205462_4.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/205536_3.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/205551_4.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/205845_1.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/206114_1.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/20660_2.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/206724_3.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/207195_4.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/207717_3.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/208107_4.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/209567_2.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/210650_1.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/212767_2.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/21552_1.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/216417_2.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/21674_3.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/217370_4.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/217603_3.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/217622_2.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/217629_1.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/217706_4.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/217815_2.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/217844_1.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/217855_4.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/217926_2.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/218066_3.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/218162_2.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/218717_2.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/218860_1.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/218939_3.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/220266_4.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/221162_3.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/221700_4.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/221839_4.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/222061_3.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/222151_2.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/222442_2.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/22287_2.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/223745.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/223745_2.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/225193_1.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/227465_4.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/230446_1.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/231814_2.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/27924.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/27924_2.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/32979_3.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/35538.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/35538.htmhttps://www.4399.com/flash/32979_3.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/35538_3.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/3881_4.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/3883_2.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/39379_2.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/40779_3.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/41193_1.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/42760_2.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/43689_1.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/43841_1.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/47931_1.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/48272_2.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/48504.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/48504_4.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/55146_4.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/59227_2.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/60369_2.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/6232_3.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/63805_4.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/65731_2.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/69112_4.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/69156_1.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/70215_3.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/72526_2.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/73386.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/776_1.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/79452_4.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/81895_2.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/83345_4.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/85646_1.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/87425_2.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/88902_1.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/90302_3.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/93015_1.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/93398_3.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/93551_3.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/yzzrhj.htm
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/zmhj.htm
Source: msedgewebview2.exe, 00000007.00000002.2571123797.00002C00004D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.4399.com/flash/zmhj.htm#search3-6407
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.91duba.com/?
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.91duba.com/?f=
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.baidu.com/?tn=
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.baidu.com/s?tn=15007414_9_dg&wd=
Source: msedgewebview2.exe, 00000007.00000002.2568400095.00002C00000F8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.catcert.net/verarrel
Source: msedgewebview2.exe, 0000000A.00000002.2542540433.000056B000024000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.cisco.com/c/en/us/about/legal/privacy-full.html
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.douyin.com/?ug_source=
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.flash.cn/success
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.hao123.com/?tn=
Source: msedgewebview2.exe, 00000007.00000002.2571003459.00002C0000464000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.huobi.com/?utm_source=UT&utm_medium=prodnews&inviter_id=
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.iduba.com/sv.html?f=
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.jiegeng.com
Source: msedgewebview2.exe, 00000007.00000002.2571123797.00002C00004D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ludashi.com/cms/server/monitor.php?id=
Source: msedgewebview2.exe, 00000007.00000002.2571003459.00002C0000464000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000000C.00000002.2455885401.000066C000898000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000000C.00000003.2440350378.000066C000898000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.microsoftnews.cn/
Source: msedgewebview2.exe, 00000007.00000002.2571003459.00002C0000464000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000000C.00000002.2455885401.000066C000898000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000000C.00000003.2440350378.000066C000898000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.microsoftnews.com/
Source: msedgewebview2.exe, 00000007.00000002.2567998965.00002C0000054000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000000C.00000002.2452564393.000066C0002A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.msn.cn/
Source: msedgewebview2.exe, 00000007.00000002.2571003459.00002C0000464000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000000C.00000002.2452564393.000066C0002A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.nate.com/?f=nateontb
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.newduba.cn/?
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.newduba.cn/?f=
Source: msedgewebview2.exe, 0000000A.00000002.2542479398.000056B00000C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.nic.cz/odvr/
Source: msedgewebview2.exe, 0000000A.00000002.2542479398.000056B00000C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.nic.cz/odvr/harV
Source: msedgewebview2.exe, 00000007.00000002.2575827987.00002C0000DBC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.pdfccompare.com/
Source: msedgewebview2.exe, 00000007.00000002.2571346329.00002C000052C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000002.2574088065.00002C0000A3C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000000C.00000002.2446933673.00000211E7FF7000.00000004.10000000.00040000.00000000.sdmp String found in binary or memory: https://www.pdfconvertercompare.com
Source: msedgewebview2.exe, 0000000C.00000002.2457110380.000066C00097C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000000C.00000002.2454638758.000066C000628000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.pdfconvertercompare.com/
Source: msedgewebview2.exe, 0000000A.00000003.2436094892.000056B000114000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.pdfconvertercompare.com/(
Source: msedgewebview2.exe, 0000000C.00000002.2454638758.000066C000628000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.pdfconvertercompare.com/f
Source: msedgewebview2.exe, 0000000C.00000002.2452564393.000066C0002A8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000000C.00000002.2454329253.000066C00060C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.pdfconvertercompare.com/favicon.ico
Source: msedgewebview2.exe, 0000000A.00000002.2542724644.000056B000060000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.pdfconvertercompare.com/favicon.ico0.2045.47V
Source: msedgewebview2.exe, 0000000A.00000002.2542724644.000056B000060000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000000A.00000002.2542955233.000056B0000AC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.pdfconvertercompare.com/favicon.icoV
Source: msedgewebview2.exe, 0000000C.00000002.2454329253.000066C00060C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.pdfconvertercompare.com/favicon.icof
Source: msedgewebview2.exe, 0000000C.00000002.2457110380.000066C00097C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.pdfconvertercompare.com/favicon.icohttps://www.pdfconvertercompare.com/favicon.icof
Source: msedgewebview2.exe, 0000000C.00000002.2457110380.000066C00097C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.pdfconvertercompare.com/favicon.icohttps://www.pdfconvertercompare.com/mainhttps://www.p
Source: msedgewebview2.exe, 0000000C.00000002.2446933673.00000211E7FF7000.00000004.10000000.00040000.00000000.sdmp String found in binary or memory: https://www.pdfconvertercompare.com/favicon.icotamp
Source: msedgewebview2.exe, 0000000C.00000002.2453017059.000066C000326000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.pdfconvertercompare.com/main
Source: PdfConverters.exe, 00000000.00000002.2454421279.0000000024470000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.pdfconvertercompare.com/main$G
Source: PdfConverters.exe, 00000000.00000002.2446939004.0000000004D81000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.pdfconvertercompare.com/main%
Source: PdfConverters.exe, 00000000.00000002.2454281410.000000002445C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.pdfconvertercompare.com/main--embedded-browser-webview=1$E
Source: msedgewebview2.exe, 00000007.00000003.2559136358.00002C0000658000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2538598025.00002C0000684000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000002.2570920936.00002C000045F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.pdfconvertercompare.com/main/u
Source: PdfConverters.exe, app.dll.0.dr String found in binary or memory: https://www.pdfconvertercompare.com/main4r
Source: msedgewebview2.exe, 0000000C.00000002.2457110380.000066C00097C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.pdfconvertercompare.com/mainResult
Source: msedgewebview2.exe, 0000000A.00000002.2542724644.000056B000060000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.pdfconvertercompare.com/mainV
Source: msedgewebview2.exe, 00000007.00000002.2565025450.00000260E08F8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.pdfconvertercompare.com/maincom/
Source: msedgewebview2.exe, 0000000A.00000002.2542724644.000056B000060000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.pdfconvertercompare.com/maindg/117.0.2045.470
Source: msedgewebview2.exe, 00000007.00000002.2568400095.00002C00000F8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000002.2568740207.00002C0000198000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000002.2574448653.00002C0000AD4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.pdfconvertercompare.com/mainhattached
Source: msedgewebview2.exe, 0000000C.00000002.2457019765.000066C000954000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.pdfconvertercompare.com/mainotify
Source: msedgewebview2.exe, 0000000B.00000002.2549547478.0000603000108000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.pdfconvertercompare.com/or_rebuild
Source: msedgewebview2.exe, 00000007.00000002.2574448653.00002C0000AD4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.pdfconvertercompare.com9430A5A15F328E38)
Source: msedgewebview2.exe, 0000000C.00000002.2449501903.0000021A00202000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.pdfconvertercompare.comEAAF5796EFB72BD69D30D0D8054A253A
Source: msedgewebview2.exe, 0000000C.00000002.2457568288.000066C0009A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.pdfconvertercompare.comdlerX
Source: msedgewebview2.exe, 0000000A.00000002.2543407037.000056B00012C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.quad9.net/home/privacy/
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.so.com/?src=
Source: msedgewebview2.exe, 00000007.00000002.2571123797.00002C00004D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.so.com/s?ie=
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.sogou.com/web?ie=
Source: msedgewebview2.exe, 0000000C.00000002.2453399624.000066C000380000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.staging-bing-int.com/
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.startfenster.de
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.startseite24.net
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://yxtg.3zwx.cn/tg/ttfc.html?sc=
Source: msedgewebview2.exe, 00000007.00000002.2571479167.00002C0000584000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://yxtg.flamebird.cn/tg/ttfc.html?sc=
Source: msedgewebview2.exe, 00000007.00000002.2571479167.00002C0000584000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://yxtg.taojike.com.cn/tg/ttfc.html?sc=
Source: msedgewebview2.exe, 00000007.00000002.2571394300.00002C0000550000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://zum.com/?af=
Source: unknown Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown HTTPS traffic detected: 23.51.58.94:443 -> 192.168.2.5:49728 version: TLS 1.2
Source: unknown HTTPS traffic detected: 23.51.58.94:443 -> 192.168.2.5:49729 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.126.24.149:443 -> 192.168.2.5:49734 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.126.24.149:443 -> 192.168.2.5:49736 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.126.24.149:443 -> 192.168.2.5:49736 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.5:49758 version: TLS 1.2
PE file does not import any functions
Source: Microsoft.Win32.Registry.dll.0.dr Static PE information: No import functions for PE file found
Source: Microsoft.VisualBasic.dll.0.dr Static PE information: No import functions for PE file found
Source: System.Buffers.dll.0.dr Static PE information: No import functions for PE file found
Source: Microsoft.VisualBasic.Core.dll.0.dr Static PE information: No import functions for PE file found
Source: System.AppContext.dll.0.dr Static PE information: No import functions for PE file found
Source: Microsoft.CSharp.dll.0.dr Static PE information: No import functions for PE file found
Source: Microsoft.Win32.Primitives.dll.0.dr Static PE information: No import functions for PE file found
Sample file is different than original file name gathered from version info
Source: PdfConverters.exe, 00000000.00000002.2481740410.000000006CC2F000.00000002.00000001.01000000.00000008.sdmp Binary or memory string: OriginalFilename.NET Core Host Policy - 3.1.32T vs PdfConverters.exe
Source: PdfConverters.exe, 00000000.00000002.2482007980.000000006E382000.00000020.00000001.01000000.00000016.sdmp Binary or memory string: OriginalFilenameMicrosoft.Win32.Primitives.dllJ vs PdfConverters.exe
Source: PdfConverters.exe, 00000000.00000002.2451837571.0000000007E92000.00000002.00000001.01000000.00000021.sdmp Binary or memory string: OriginalFilenamemscorlib.dllJ vs PdfConverters.exe
Source: PdfConverters.exe, 00000000.00000002.2457838985.000000006B112000.00000020.00000001.01000000.00000019.sdmp Binary or memory string: OriginalFilenameSystem.Runtime.Extensions.dllJ vs PdfConverters.exe
Source: PdfConverters.exe, 00000000.00000002.2457688660.000000006B102000.00000020.00000001.01000000.0000001A.sdmp Binary or memory string: OriginalFilenameSystem.Diagnostics.Debug.dllJ vs PdfConverters.exe
Source: PdfConverters.exe, 00000000.00000002.2458725706.000000006B1E2000.00000020.00000001.01000000.00000014.sdmp Binary or memory string: OriginalFilenameSystem.Threading.dllJ vs PdfConverters.exe
Source: PdfConverters.exe, 00000000.00000002.2455544252.000000006AC72000.00000020.00000001.01000000.0000002A.sdmp Binary or memory string: OriginalFilenameSystem.Threading.Tasks.dllJ vs PdfConverters.exe
Source: PdfConverters.exe, 00000000.00000002.2459166964.000000006B276000.00000020.00000001.01000000.0000000E.sdmp Binary or memory string: OriginalFilenameSystem.Windows.Forms.dll@ vs PdfConverters.exe
Source: PdfConverters.exe, 00000000.00000002.2456830161.000000006B002000.00000020.00000001.01000000.0000001D.sdmp Binary or memory string: OriginalFilenameSystem.Threading.Thread.dllJ vs PdfConverters.exe
Source: PdfConverters.exe, 00000000.00000002.2456948310.000000006B012000.00000020.00000001.01000000.0000001C.sdmp Binary or memory string: OriginalFilenameSystem.ComponentModel.EventBasedAsync.dllJ vs PdfConverters.exe
Source: PdfConverters.exe, 00000000.00000002.2458851996.000000006B203000.00000020.00000001.01000000.00000013.sdmp Binary or memory string: OriginalFilenameSystem.Diagnostics.Process.dllJ vs PdfConverters.exe
Source: PdfConverters.exe, 00000000.00000002.2482257049.000000006F702000.00000020.00000001.01000000.00000010.sdmp Binary or memory string: OriginalFilenameSystem.Drawing.Primitives.dllJ vs PdfConverters.exe
Source: PdfConverters.exe, 00000000.00000002.2455456821.000000006AC62000.00000020.00000001.01000000.0000002B.sdmp Binary or memory string: OriginalFilenameSystem.dllJ vs PdfConverters.exe
Source: PdfConverters.exe, 00000000.00000002.2455368598.000000006AC5D000.00000002.00000001.01000000.0000002C.sdmp Binary or memory string: OriginalFilenameWebView2Loader.dll~/ vs PdfConverters.exe
Source: PdfConverters.exe, 00000000.00000002.2477313553.000000006BF65000.00000020.00000001.01000000.0000000A.sdmp Binary or memory string: OriginalFilenameSystem.Private.CoreLib.dllJ vs PdfConverters.exe
Source: PdfConverters.exe, 00000000.00000002.2456745883.000000006AFF2000.00000020.00000001.01000000.0000001E.sdmp Binary or memory string: OriginalFilenameAccessibility-version.dll@ vs PdfConverters.exe
Source: PdfConverters.exe, 00000000.00000002.2455887517.000000006ACB2000.00000020.00000001.01000000.00000027.sdmp Binary or memory string: OriginalFilenameSystem.Buffers.dllJ vs PdfConverters.exe
Source: PdfConverters.exe, 00000000.00000002.2458056761.000000006B142000.00000020.00000001.01000000.00000018.sdmp Binary or memory string: OriginalFilenameSystem.Diagnostics.TraceSource.dllJ vs PdfConverters.exe
Source: PdfConverters.exe, 00000000.00000002.2451202375.0000000007CEA000.00000002.00000001.01000000.0000001F.sdmp Binary or memory string: OriginalFilenameMicrosoft.Web.WebView2.WinForms.dll^ vs PdfConverters.exe
Source: PdfConverters.exe, 00000000.00000002.2453358482.0000000009E30000.00000002.00000001.00040000.00000035.sdmp Binary or memory string: OriginalFilenameUNKNOWN_FILEJ vs PdfConverters.exe
Source: PdfConverters.exe, 00000000.00000002.2482126842.000000006E5A2000.00000020.00000001.01000000.00000012.sdmp Binary or memory string: OriginalFilenameSystem.Runtime.InteropServices.dllJ vs PdfConverters.exe
Source: PdfConverters.exe, 00000000.00000002.2482391905.000000006F722000.00000020.00000001.01000000.0000000F.sdmp Binary or memory string: OriginalFilenameSystem.ComponentModel.Primitives.dllJ vs PdfConverters.exe
Source: PdfConverters.exe, 00000000.00000002.2455761226.000000006AC92000.00000020.00000001.01000000.00000028.sdmp Binary or memory string: OriginalFilenameMicrosoft.Win32.SystemEvents.dllJ vs PdfConverters.exe
Source: PdfConverters.exe, 00000000.00000002.2456022221.000000006ACC2000.00000020.00000001.01000000.00000026.sdmp Binary or memory string: OriginalFilenameSystem.IO.FileSystem.dllJ vs PdfConverters.exe
Source: PdfConverters.exe, 00000000.00000002.2451750576.0000000007E84000.00000002.00000001.01000000.00000020.sdmp Binary or memory string: OriginalFilenameMicrosoft.Web.WebView2.Core.dll\ vs PdfConverters.exe
Source: PdfConverters.exe, 00000000.00000002.2481916500.000000006E1A0000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: OriginalFilename.NET Core Host Resolver - 3.1.32T vs PdfConverters.exe
Source: PdfConverters.exe, 00000000.00000002.2458498219.000000006B1B2000.00000020.00000001.01000000.00000015.sdmp Binary or memory string: OriginalFilenameSystem.Memory.dllJ vs PdfConverters.exe
Source: PdfConverters.exe, 00000000.00000002.2456220158.000000006ACF2000.00000020.00000001.01000000.00000025.sdmp Binary or memory string: OriginalFilenameSystem.Private.Uri.dllJ vs PdfConverters.exe
Source: PdfConverters.exe, 00000000.00000002.2458269793.000000006B163000.00000020.00000001.01000000.00000017.sdmp Binary or memory string: OriginalFilenameSystem.Collections.dllJ vs PdfConverters.exe
Source: PdfConverters.exe, 00000000.00000002.2458996966.000000006B242000.00000020.00000001.01000000.00000011.sdmp Binary or memory string: OriginalFilenameSystem.Collections.Specialized.dllJ vs PdfConverters.exe
Source: PdfConverters.exe, 00000000.00000002.2456563102.000000006AF54000.00000020.00000001.01000000.00000022.sdmp Binary or memory string: OriginalFilenameSystem.ComponentModel.TypeConverter.dllJ vs PdfConverters.exe
Source: PdfConverters.exe, 00000000.00000002.2457159749.000000006B024000.00000020.00000001.01000000.0000001B.sdmp Binary or memory string: OriginalFilenameSystem.Drawing.Common.dllJ vs PdfConverters.exe
Source: PdfConverters.exe, 00000000.00000002.2457159749.000000006B024000.00000020.00000001.01000000.0000001B.sdmp Binary or memory string: s_lastOriginalFileName vs PdfConverters.exe
Source: PdfConverters.exe, 00000000.00000002.2455630350.000000006AC82000.00000020.00000001.01000000.00000029.sdmp Binary or memory string: OriginalFilenameSystem.ComponentModel.dllJ vs PdfConverters.exe
Source: PdfConverters.exe, 00000000.00000002.2481559239.000000006CBA7000.00000002.00000001.01000000.00000009.sdmp Binary or memory string: OriginalFilenameCoreCLR.dllJ vs PdfConverters.exe
Source: PdfConverters.exe, 00000000.00000002.2475938123.000000006BF3C000.00000002.00000001.01000000.0000000B.sdmp Binary or memory string: OriginalFilenameclrjit.dllJ vs PdfConverters.exe
Source: PdfConverters.exe, 00000000.00000002.2456367745.000000006AF42000.00000020.00000001.01000000.00000023.sdmp Binary or memory string: OriginalFilenameSystem.Drawing.dll@ vs PdfConverters.exe
Source: PdfConverters.exe, 00000000.00000002.2482519360.000000006F802000.00000020.00000001.01000000.0000000D.sdmp Binary or memory string: OriginalFilenameSystem.Runtime.dllJ vs PdfConverters.exe
Source: PdfConverters.exe Binary or memory string: OriginalFilenameWebView2Loader.dll~/ vs PdfConverters.exe
Source: PdfConverters.exe Binary or memory string: OriginalFilenameMicrosoft.CSharp.dllJ vs PdfConverters.exe
Source: PdfConverters.exe Binary or memory string: OriginalFilenameMicrosoft.VisualBasic.Core.dllJ vs PdfConverters.exe
Source: PdfConverters.exe Binary or memory string: OriginalFilenameMicrosoft.VisualBasic.dllJ vs PdfConverters.exe
Source: PdfConverters.exe Binary or memory string: OriginalFilenameMicrosoft.Win32.Primitives.dllJ vs PdfConverters.exe
Source: PdfConverters.exe Binary or memory string: OriginalFilenameMicrosoft.Win32.Registry.dllJ vs PdfConverters.exe
Source: PdfConverters.exe Binary or memory string: OriginalFilenameSystem.AppContext.dllJ vs PdfConverters.exe
Source: PdfConverters.exe Binary or memory string: OriginalFilenameSystem.Buffers.dllJ vs PdfConverters.exe
Source: PdfConverters.exe Binary or memory string: OriginalFilenameSystem.Collections.Concurrent.dllJ vs PdfConverters.exe
Source: PdfConverters.exe Binary or memory string: OriginalFilenameSystem.Collections.Immutable.dllJ vs PdfConverters.exe
Source: PdfConverters.exe Binary or memory string: OriginalFilenameSystem.Collections.NonGeneric.dllJ vs PdfConverters.exe
Source: PdfConverters.exe Binary or memory string: OriginalFilenameSystem.Collections.Specialized.dllJ vs PdfConverters.exe
Source: PdfConverters.exe Binary or memory string: OriginalFilenameSystem.Collections.dllJ vs PdfConverters.exe
Source: PdfConverters.exe Binary or memory string: OriginalFilenameSystem.ComponentModel.Annotations.dllJ vs PdfConverters.exe
Source: PdfConverters.exe Binary or memory string: OriginalFilenameSystem.ComponentModel.DataAnnotations.dllJ vs PdfConverters.exe
Source: PdfConverters.exe Binary or memory string: OriginalFilenameSystem.ComponentModel.EventBasedAsync.dllJ vs PdfConverters.exe
Source: PdfConverters.exe Binary or memory string: OriginalFilenameSystem.ComponentModel.Primitives.dllJ vs PdfConverters.exe
Source: PdfConverters.exe Binary or memory string: OriginalFilenameSystem.ComponentModel.TypeConverter.dllJ vs PdfConverters.exe
Source: PdfConverters.exe Binary or memory string: OriginalFilenameSystem.ComponentModel.dllJ vs PdfConverters.exe
Source: PdfConverters.exe Binary or memory string: OriginalFilenameSystem.Configuration.dllJ vs PdfConverters.exe
Source: PdfConverters.exe Binary or memory string: OriginalFilenameSystem.Console.dllJ vs PdfConverters.exe
Source: PdfConverters.exe Binary or memory string: OriginalFilenameSystem.Core.dllJ vs PdfConverters.exe
Source: PdfConverters.exe Binary or memory string: OriginalFilenameSystem.Data.Common.dllJ vs PdfConverters.exe
Source: PdfConverters.exe Binary or memory string: OriginalFilenameSystem.Data.DataSetExtensions.dllJ vs PdfConverters.exe
Source: PdfConverters.exe Binary or memory string: OriginalFilenameSystem.Data.dllJ vs PdfConverters.exe
Source: PdfConverters.exe Binary or memory string: OriginalFilenameSystem.Diagnostics.Contracts.dllJ vs PdfConverters.exe
Source: PdfConverters.exe Binary or memory string: OriginalFilenameSystem.Diagnostics.Debug.dllJ vs PdfConverters.exe
Source: PdfConverters.exe Binary or memory string: OriginalFilenameSystem.Diagnostics.DiagnosticSource.dllJ vs PdfConverters.exe
Source: PdfConverters.exe Binary or memory string: OriginalFilenameSystem.Diagnostics.FileVersionInfo.dllJ vs PdfConverters.exe
Source: PdfConverters.exe Binary or memory string: get_OriginalFilename vs PdfConverters.exe
Source: PdfConverters.exe Binary or memory string: _originalFilename vs PdfConverters.exe
Source: PdfConverters.exe Binary or memory string: #Blobget_IsPatchedget_PrivateBuildget_IsPrivateBuildget_SpecialBuildget_IsSpecialBuildget_Languageget_FileNameget_InternalNameget_ProductNameget_CompanyNameget_OriginalFilenameget_IsPreReleaseToStringget_IsDebugget_FileVersionget_ProductVersionget_FileDescriptionSystem.Diagnostics.FileVersionInfoGetVersionInfoSystem.DiagnosticsFxResources.System.Diagnostics.FileVersionInfo.SR.resourcesget_LegalTrademarksget_Commentsget_LegalCopyrightget_FileBuildPartget_ProductBuildPartget_FilePrivatePartget_ProductPrivatePartget_FileMajorPartget_ProductMajorPartget_FileMinorPartget_ProductMinorPartUInt32ReadInt16System.IOVerLanguageNameWVerQueryValueWGetFileVersionInfoSizeExWGetFileVersionInfoExWlpDataIsPathFullyQualified_isPrivateBuild_isSpecialBuildAppenddwordcodepageGetFileVersionLanguageRuntimeFieldHandlelpdwHandleFile_fileNamelpwstrFilenameSystem.RuntimeAppendLineValueTypePtrToStructureget_InvariantCultureAssemblyMetadataAttributeCompilerGeneratedAttributeUnverifiableCodeAttributeDebuggableAttributeAssemblyTitleAttributeAssemblyFileVersionAttributeAssemblyInformationalVersionAttributeAssemblyDescriptionAttributeAssemblyDefaultAliasAttributeDefaultDllImportSearchPathsAttributeCompilationRelaxationsAttributeAssemblyProductAttributeAssemblyCopyrightAttributeCLSCompliantAttributeAssemblyCompanyAttributeRuntimeCompatibilityAttributeBytevaluecchLangwLangszLangDllImportSearchPathGetFullPathPtrToStringUnilpSubBlockpBlockMarshalkernel32.dllversion.dllSystem.Diagnostics.FileVersionInfo.dllSystem.IO.FileSystemBooleanpuLendwLenSystem.GlobalizationSystem.ReflectionFileNotFoundExceptionCultureInfoZeroIFormatProviderStringBuilderlplpBufferSystem.Resources.ResourceManager.ctormemPtrmemIntPtrSystem.Runtime.InteropServicesSystem.Runtime.CompilerServicesDebuggingModesdwFlagsSystem.Runtime.ExtensionsRuntimeHelpersExistsFormatObjectop_ExplicitSystem.TextInitializeArrayop_InequalitySystem.SecurityEmpty__StaticArrayInitTypeSize=12Kernel3257B72EBBD24148E995EAB154EC3D9EB0BE3A6C82<Module><PrivateImplementationDetails>HIWORDLOWORDVS_FIXEDFILEINFOdwFileDateLSdwFileVersionLSdwProductVersionLSdwFileDateMSdwFileVersionMSdwProductVersionMSdwFileOS_isPatched_fileBuild_privateBuild_specialBuild_productBuildGetVersionInfoForCodePage_languageVerLanguageName_internalName_productName_companyName_originalFilenamedwFileTypedwFileSubtypedwSignature_isPreRelease_filePrivate_productPrivateVerQueryValueGetFileVersionString_isDebugdwFileFlagsMaskdwStrucVersion_fileVersion_productVersion_fileDescriptionGetFixedFileInfoInterop_fileMajor_productMajor_fileMinor_productMinor.cctors_fallbackLanguageCodePagesdwFileFlags_legalTrademarks_comments_legalCopyrightGetFileVersionInfoSizeExGetFileVersionInfoExConvertTo8DigitHexGetVarEntry vs PdfConverters.exe
Source: PdfConverters.exe Binary or memory string: %File: %InternalName: %OriginalFilename: %FileVersion: %FileDescription: %Product: %ProductVersion: %Debug: %Patched: %PreRelease: %PrivateBuild: %SpecialBuild: %Language: vs PdfConverters.exe
Source: PdfConverters.exe Binary or memory string: LegalCopyright!OriginalFilename vs PdfConverters.exe
Source: PdfConverters.exe Binary or memory string: OriginalFilenameSystem.Diagnostics.Process.dllJ vs PdfConverters.exe
Source: PdfConverters.exe Binary or memory string: OriginalFilenameSystem.Diagnostics.StackTrace.dllJ vs PdfConverters.exe
Source: PdfConverters.exe Binary or memory string: OriginalFilenameSystem.Diagnostics.TextWriterTraceListener.dllJ vs PdfConverters.exe
Source: PdfConverters.exe Binary or memory string: OriginalFilenameSystem.Diagnostics.Tools.dllJ vs PdfConverters.exe
Source: PdfConverters.exe Binary or memory string: OriginalFilenameSystem.Diagnostics.TraceSource.dllJ vs PdfConverters.exe
Source: PdfConverters.exe Binary or memory string: OriginalFilenameSystem.Diagnostics.Tracing.dllJ vs PdfConverters.exe
Source: PdfConverters.exe Binary or memory string: OriginalFilenameSystem.Drawing.Primitives.dllJ vs PdfConverters.exe
Source: PdfConverters.exe Binary or memory string: OriginalFilenameSystem.Dynamic.Runtime.dllJ vs PdfConverters.exe
Source: PdfConverters.exe Binary or memory string: OriginalFilenameSystem.Globalization.Calendars.dllJ vs PdfConverters.exe
Source: PdfConverters.exe Binary or memory string: OriginalFilenameSystem.Globalization.Extensions.dllJ vs PdfConverters.exe
Source: PdfConverters.exe Binary or memory string: OriginalFilenameSystem.Globalization.dllJ vs PdfConverters.exe
Source: PdfConverters.exe Binary or memory string: OriginalFilenameSystem.IO.Compression.Brotli.dllJ vs PdfConverters.exe
Source: PdfConverters.exe Binary or memory string: OriginalFilenameSystem.IO.Compression.FileSystem.dllJ vs PdfConverters.exe
Source: PdfConverters.exe Binary or memory string: OriginalFilenameSystem.IO.Compression.ZipFile.dllJ vs PdfConverters.exe
Source: PdfConverters.exe Binary or memory string: OriginalFilenameSystem.IO.Compression.dllJ vs PdfConverters.exe
Source: PdfConverters.exe Binary or memory string: OriginalFilenameSystem.IO.FileSystem.AccessControl.dllJ vs PdfConverters.exe
Source: PdfConverters.exe Binary or memory string: OriginalFilenameSystem.IO.FileSystem.DriveInfo.dllJ vs PdfConverters.exe
Source: PdfConverters.exe Binary or memory string: OriginalFilenameSystem.IO.FileSystem.Primitives.dllJ vs PdfConverters.exe
Source: PdfConverters.exe Binary or memory string: OriginalFilenameSystem.IO.FileSystem.Watcher.dllJ vs PdfConverters.exe
Source: PdfConverters.exe Binary or memory string: OriginalFilenameSystem.IO.FileSystem.dllJ vs PdfConverters.exe
Source: PdfConverters.exe Binary or memory string: OriginalFilenameSystem.IO.IsolatedStorage.dllJ vs PdfConverters.exe
Source: PdfConverters.exe Binary or memory string: OriginalFilenameSystem.IO.MemoryMappedFiles.dllJ vs PdfConverters.exe
Source: PdfConverters.exe Binary or memory string: OriginalFilenameSystem.IO.Pipes.AccessControl.dllJ vs PdfConverters.exe
Source: PdfConverters.exe Binary or memory string: OriginalFilenameSystem.IO.Pipes.dllJ vs PdfConverters.exe
Source: PdfConverters.exe Binary or memory string: OriginalFilenameSystem.IO.UnmanagedMemoryStream.dllJ vs PdfConverters.exe
Source: PdfConverters.exe Binary or memory string: OriginalFilenameSystem.IO.dllJ vs PdfConverters.exe
Source: PdfConverters.exe Binary or memory string: OriginalFilenameSystem.Linq.Expressions.dllJ vs PdfConverters.exe
Uses 32bit PE files
Source: PdfConverters.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: classification engine Classification label: mal45.mine.winEXE@26/659@11/7
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Mutant created: NULL
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net Jump to behavior
Source: PdfConverters.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: PdfConverters.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.98%
Source: C:\Users\user\Desktop\PdfConverters.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: msedgewebview2.exe, 00000007.00000003.2434304242.00002C00006D8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2440133379.00002C00006D8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000002.2572101281.00002C00006D8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000007.00000003.2430627497.00002C00006D8000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: PdfConverters.exe ReversingLabs: Detection: 31%
Source: PdfConverters.exe String found in binary or memory: -Start Disk Number cannot be held in an Int64.
Source: C:\Users\user\Desktop\PdfConverters.exe File read: C:\Users\user\Desktop\PdfConverters.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\PdfConverters.exe "C:\Users\user\Desktop\PdfConverters.exe"
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http:///
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 --field-trial-handle=2328,i,16201944400505639363,503574586948334668,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\PdfConverters.exe Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=PdfConverters.exe --webview-exe-version=1.0 --user-data-dir="C:\Users\user\AppData\Local\Temp\PdfConverters.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=0 --edge-webview-custom-scheme --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=3160.7800.5259682614117425049
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\user\AppData\Local\Temp\PdfConverters.WebView2\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\user\AppData\Local\Temp\PdfConverters.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=117.0.2045.47 --initial-client-data=0x15c,0x160,0x164,0x138,0x170,0x7ff899758e88,0x7ff899758e98,0x7ff899758ea8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Temp\PdfConverters.WebView2\EBWebView" --webview-exe-name=PdfConverters.exe --webview-exe-version=1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --edge-webview-custom-scheme --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1828 --field-trial-handle=1832,i,9339170682265001696,394570848035688689,262144 --enable-features=MojoIpcz /prefetch:2
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Temp\PdfConverters.WebView2\EBWebView" --webview-exe-name=PdfConverters.exe --webview-exe-version=1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --edge-webview-custom-scheme --mojo-platform-channel-handle=3100 --field-trial-handle=1832,i,9339170682265001696,394570848035688689,262144 --enable-features=MojoIpcz /prefetch:3
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Temp\PdfConverters.WebView2\EBWebView" --webview-exe-name=PdfConverters.exe --webview-exe-version=1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --edge-webview-custom-scheme --mojo-platform-channel-handle=3340 --field-trial-handle=1832,i,9339170682265001696,394570848035688689,262144 --enable-features=MojoIpcz /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Temp\PdfConverters.WebView2\EBWebView" --webview-exe-name=PdfConverters.exe --webview-exe-version=1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --edge-webview-custom-scheme --disable-nacl --first-renderer-process --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1714168248658982 --launch-time-ticks=4314058757 --mojo-platform-channel-handle=3636 --field-trial-handle=1832,i,9339170682265001696,394570848035688689,262144 --enable-features=MojoIpcz /prefetch:1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 --field-trial-handle=2328,i,16201944400505639363,503574586948334668,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\user\AppData\Local\Temp\PdfConverters.WebView2\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\user\AppData\Local\Temp\PdfConverters.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=117.0.2045.47 --initial-client-data=0x15c,0x160,0x164,0x138,0x170,0x7ff899758e88,0x7ff899758e98,0x7ff899758ea8 Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Temp\PdfConverters.WebView2\EBWebView" --webview-exe-name=PdfConverters.exe --webview-exe-version=1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --edge-webview-custom-scheme --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1828 --field-trial-handle=1832,i,9339170682265001696,394570848035688689,262144 --enable-features=MojoIpcz /prefetch:2 Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Temp\PdfConverters.WebView2\EBWebView" --webview-exe-name=PdfConverters.exe --webview-exe-version=1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --edge-webview-custom-scheme --mojo-platform-channel-handle=3100 --field-trial-handle=1832,i,9339170682265001696,394570848035688689,262144 --enable-features=MojoIpcz /prefetch:3 Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Temp\PdfConverters.WebView2\EBWebView" --webview-exe-name=PdfConverters.exe --webview-exe-version=1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --edge-webview-custom-scheme --mojo-platform-channel-handle=3340 --field-trial-handle=1832,i,9339170682265001696,394570848035688689,262144 --enable-features=MojoIpcz /prefetch:8 Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Temp\PdfConverters.WebView2\EBWebView" --webview-exe-name=PdfConverters.exe --webview-exe-version=1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --edge-webview-custom-scheme --disable-nacl --first-renderer-process --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1714168248658982 --launch-time-ticks=4314058757 --mojo-platform-channel-handle=3636 --field-trial-handle=1832,i,9339170682265001696,394570848035688689,262144 --enable-features=MojoIpcz /prefetch:1 Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: version.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: windows.system.profile.platformdiagnosticsandusagedatasettings.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: kbdus.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: windows.system.profile.platformdiagnosticsandusagedatasettings.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: mdmregistration.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: mdmregistration.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: omadmapi.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: dmcmnutils.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: iri.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: dsreg.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: windows.ui.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: windowmanagementapi.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: inputhost.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: windows.security.authentication.web.core.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: mscms.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: coloradapterclient.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: devobj.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: dataexchange.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: d3d11.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: dcomp.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: uiautomationcore.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: atlthunk.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: directmanipulation.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: resourcepolicyclient.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: mf.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: mfplat.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: rtworkq.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: hevcdecoder.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: dolbydecmft.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: mfperfhelper.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: d3d11.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: d3d10warp.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: dxcore.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: dcomp.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: windows.security.authentication.onlineid.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: ncryptprov.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Section loaded: winmm.dll
Source: C:\Users\user\Desktop\PdfConverters.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{56ad4c5d-b908-4f85-8ff1-7940c29b3bcf}\InProcServer32 Jump to behavior
Source: PdfConverters.exe Static PE information: certificate valid
Source: PdfConverters.exe Static file information: File size 157801528 > 1048576
Source: PdfConverters.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: PdfConverters.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: PdfConverters.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: PdfConverters.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: PdfConverters.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: PdfConverters.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: PdfConverters.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: PdfConverters.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: System.Threading.pdb source: PdfConverters.exe, 00000000.00000002.2458725706.000000006B1E2000.00000020.00000001.01000000.00000014.sdmp, System.Threading.dll.0.dr
Source: Binary string: /_/artifacts/obj/System.Windows.Forms/Release/netcoreapp3.1/System.Windows.Forms.pdbSHA256 source: PdfConverters.exe, 00000000.00000002.2459166964.000000006B6DD000.00000020.00000001.01000000.0000000E.sdmp
Source: Binary string: System.Data.pdb source: PdfConverters.exe
Source: Binary string: System.ComponentModel.ni.pdb source: PdfConverters.exe
Source: Binary string: System.IO.FileSystem.DriveInfo.ni.pdbRSDS source: PdfConverters.exe
Source: Binary string: System.IO.FileSystem.DriveInfo.ni.pdb source: PdfConverters.exe
Source: Binary string: System.Diagnostics.Process.ni.pdbRSDS source: PdfConverters.exe
Source: Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: api-ms-win-core-sysinfo-l1-1-0.dll.0.dr
Source: Binary string: System.Drawing.Common.ni.pdb source: PdfConverters.exe, 00000000.00000002.2457159749.000000006B024000.00000020.00000001.01000000.0000001B.sdmp
Source: Binary string: System.IO.FileSystem.Watcher.pdb source: PdfConverters.exe
Source: Binary string: System.IO.Compression.Brotli.pdb source: PdfConverters.exe
Source: Binary string: System.Linq.Expressions.ni.pdbRSDS source: PdfConverters.exe
Source: Binary string: System.Diagnostics.Tools.pdb source: PdfConverters.exe
Source: Binary string: System.Globalization.pdb source: PdfConverters.exe
Source: Binary string: System.ComponentModel.EventBasedAsync.pdb source: PdfConverters.exe
Source: Binary string: System.IO.MemoryMappedFiles.ni.pdb source: PdfConverters.exe
Source: Binary string: System.Data.DataSetExtensions.pdb@/runtimes/win-x86/lib/netcoreapp3.1/System.Data.DataSetExtensions.dll source: PdfConverters.exe
Source: Binary string: Microsoft.VisualBasic.pdb source: PdfConverters.exe
Source: Binary string: System.IO.Compression.ZipFile.pdb0lruntimes/win-x86/lib/netcoreapp3.1/System.IO.Compression.ZipFile.dll source: PdfConverters.exe, System.IO.Compression.ZipFile.dll.0.dr
Source: Binary string: System.ComponentModel.Annotations.ni.pdbRSDSq source: PdfConverters.exe
Source: Binary string: D:\a\_work\1\s\third_party\edge_webview2\win\winforms_control\Microsoft.Web.WebView2.WinForms\obj\release\netcoreapp3.0\Microsoft.Web.WebView2.WinForms.pdb source: PdfConverters.exe, 00000000.00000002.2451093235.0000000007CE2000.00000002.00000001.01000000.0000001F.sdmp
Source: Binary string: System.Xml.XmlSerializer.ni.pdb source: System.Xml.XmlSerializer.dll.0.dr
Source: Binary string: System.Globalization.Extensions.pdb 0runtimes/win-x86/lib/netcoreapp3.1/System.Globalization.Extensions.dll source: PdfConverters.exe
Source: Binary string: System.IO.ni.pdbRSDS source: PdfConverters.exe
Source: Binary string: System.Runtime.Serialization.Primitives.ni.pdbRSDS source: System.Runtime.Serialization.Primitives.dll.0.dr
Source: Binary string: System.ComponentModel.EventBasedAsync.ni.pdb source: PdfConverters.exe
Source: Binary string: D:\a\_work\e\src\out\Release\WebView2Loader.dll.pdb source: PdfConverters.exe
Source: Binary string: System.ComponentModel.pdbD2runtimes/win-x86/lib/netcoreapp3.1/System.ComponentModel.dll source: PdfConverters.exe
Source: Binary string: D:\a\_work\1\s\bin\obj\Windows_NT.x86.Release\src\dlls\mscorrc\full\Release\mscorrc.debug.pdb source: PdfConverters.exe, 00000000.00000002.2453358482.0000000009E30000.00000002.00000001.00040000.00000035.sdmp
Source: Binary string: System.Xml.XmlSerializer.pdbX9runtimes/win-x86/lib/netcoreapp3.1/System.Xml.XmlSerializer.dll source: System.Xml.XmlSerializer.dll.0.dr
Source: Binary string: System.Memory.pdb source: PdfConverters.exe, 00000000.00000002.2458498219.000000006B1B2000.00000020.00000001.01000000.00000015.sdmp
Source: Binary string: System.Diagnostics.TraceSource.pdbH source: PdfConverters.exe
Source: Binary string: System.ComponentModel.Annotations.pdb@ source: PdfConverters.exe
Source: Binary string: D:\a\_work\1\s\bin\obj\Windows_NT.x86.Release\src\jit\standalone\Release\clrjit.pdb source: PdfConverters.exe, 00000000.00000002.2475798115.000000006BF1F000.00000002.00000001.01000000.0000000B.sdmp
Source: Binary string: System.Threading.Thread.pdb source: PdfConverters.exe, 00000000.00000002.2456830161.000000006B002000.00000020.00000001.01000000.0000001D.sdmp
Source: Binary string: System.Diagnostics.FileVersionInfo.ni.pdb source: PdfConverters.exe
Source: Binary string: System.Buffers.ni.pdb source: PdfConverters.exe, System.Buffers.dll.0.dr
Source: Binary string: System.Collections.pdb source: PdfConverters.exe
Source: Binary string: System.Collections.Specialized.ni.pdb source: PdfConverters.exe
Source: Binary string: /_/artifacts/obj/System.Drawing.Common/netcoreapp3.0-Windows_NT-Release/System.Drawing.Common.pdb source: PdfConverters.exe, 00000000.00000002.2457159749.000000006B024000.00000020.00000001.01000000.0000001B.sdmp
Source: Binary string: System.Diagnostics.DiagnosticSource.ni.pdbRSDSM source: PdfConverters.exe
Source: Binary string: System.IO.UnmanagedMemoryStream.ni.pdb source: PdfConverters.exe
Source: Binary string: Microsoft.VisualBasic.Core.ni.pdbRSDS source: PdfConverters.exe
Source: Binary string: Microsoft.VisualBasic.ni.pdb source: PdfConverters.exe
Source: Binary string: System.ComponentModel.DataAnnotations.pdb source: PdfConverters.exe
Source: Binary string: System.IO.MemoryMappedFiles.pdb source: PdfConverters.exe
Source: Binary string: PresentationFramework.Aero.ni.pdbRSDS source: PresentationFramework.Aero.dll.0.dr
Source: Binary string: System.Runtime.Serialization.Primitives.ni.pdb source: System.Runtime.Serialization.Primitives.dll.0.dr
Source: Binary string: System.Reflection.TypeExtensions.ni.pdbRSDS] source: System.Reflection.TypeExtensions.dll.0.dr
Source: Binary string: System.Diagnostics.Tools.ni.pdb source: PdfConverters.exe
Source: Binary string: System.Buffers.pdbx/runtimes/win-x86/lib/netcoreapp3.1/System.Buffers.dll source: PdfConverters.exe, System.Buffers.dll.0.dr
Source: Binary string: System.Reflection.TypeExtensions.ni.pdb source: System.Reflection.TypeExtensions.dll.0.dr
Source: Binary string: /_/artifacts/obj/Microsoft.Win32.SystemEvents/netcoreapp3.0-Windows_NT-Release/Microsoft.Win32.SystemEvents.pdb source: PdfConverters.exe, 00000000.00000002.2455761226.000000006AC92000.00000020.00000001.01000000.00000028.sdmp
Source: Binary string: miutils.pdbGCTL source: miutils.dll.0.dr
Source: Binary string: System.Data.DataSetExtensions.ni.pdbRSDS source: PdfConverters.exe
Source: Binary string: System.Private.CoreLib.ni.pdbRSDS source: PdfConverters.exe, 00000000.00000002.2477313553.000000006BF65000.00000020.00000001.01000000.0000000A.sdmp
Source: Binary string: System.Threading.Tasks.pdb source: PdfConverters.exe, 00000000.00000002.2455544252.000000006AC72000.00000020.00000001.01000000.0000002A.sdmp
Source: Binary string: System.IO.Compression.pdb source: PdfConverters.exe
Source: Binary string: /_/artifacts/obj/System.Security.Cryptography.Xml/netstandard-Release/System.Security.Cryptography.Xml.pdb source: System.Security.Cryptography.Xml.dll.0.dr
Source: Binary string: System.Console.pdb source: PdfConverters.exe
Source: Binary string: System.IO.Compression.ZipFile.ni.pdbRSDSAc source: PdfConverters.exe, System.IO.Compression.ZipFile.dll.0.dr
Source: Binary string: System.Drawing.Primitives.pdb source: PdfConverters.exe
Source: Binary string: System.ComponentModel.DataAnnotations.ni.pdbRSDSb. source: PdfConverters.exe
Source: Binary string: mscorlib.pdb source: PdfConverters.exe, 00000000.00000002.2451837571.0000000007E92000.00000002.00000001.01000000.00000021.sdmp
Source: Binary string: api-ms-win-crt-process-l1-1-0.pdb source: api-ms-win-crt-process-l1-1-0.dll.0.dr
Source: Binary string: System.IO.Compression.Brotli.pdbp source: PdfConverters.exe
Source: Binary string: System.Threading.ni.pdb source: PdfConverters.exe, 00000000.00000002.2458725706.000000006B1E2000.00000020.00000001.01000000.00000014.sdmp, System.Threading.dll.0.dr
Source: Binary string: System.IO.Compression.Brotli.ni.pdbRSDSzHs source: PdfConverters.exe
Source: Binary string: System.Collections.NonGeneric.ni.pdbRSDS source: PdfConverters.exe
Source: Binary string: System.Threading.Tasks.Parallel.ni.pdb source: System.Threading.Tasks.Parallel.dll.0.dr
Source: Binary string: System.Runtime.Extensions.ni.pdbRSDS source: PdfConverters.exe, 00000000.00000002.2457838985.000000006B112000.00000020.00000001.01000000.00000019.sdmp
Source: Binary string: System.ComponentModel.TypeConverter.pdb source: PdfConverters.exe
Source: Binary string: System.Diagnostics.TextWriterTraceListener.ni.pdbRSDS G |#c source: PdfConverters.exe, System.Diagnostics.TextWriterTraceListener.dll.0.dr
Source: Binary string: System.Diagnostics.Tracing.ni.pdb source: PdfConverters.exe, System.Diagnostics.Tracing.dll.0.dr
Source: Binary string: System.ComponentModel.DataAnnotations.ni.pdb source: PdfConverters.exe
Source: Binary string: System.Globalization.Calendars.pdb source: PdfConverters.exe
Source: Binary string: System.Runtime.Serialization.pdb source: System.Runtime.Serialization.dll.0.dr
Source: Binary string: PresentationFramework.Aero.ni.pdb source: PresentationFramework.Aero.dll.0.dr
Source: Binary string: System.Configuration.ni.pdbRSDS source: PdfConverters.exe, System.Configuration.dll.0.dr
Source: Binary string: System.Diagnostics.StackTrace.pdbTuruntimes/win-x86/lib/netcoreapp3.1/System.Diagnostics.StackTrace.dll source: PdfConverters.exe
Source: Binary string: System.Drawing.Primitives.ni.pdb source: PdfConverters.exe
Source: Binary string: System.Buffers.pdb source: PdfConverters.exe, System.Buffers.dll.0.dr
Source: Binary string: System.ComponentModel.Annotations.pdb source: PdfConverters.exe
Source: Binary string: System.ComponentModel.Annotations.ni.pdb source: PdfConverters.exe
Source: Binary string: Accessibility.ni.pdb source: PdfConverters.exe, 00000000.00000002.2456745883.000000006AFF2000.00000020.00000001.01000000.0000001E.sdmp, Accessibility.dll.0.dr
Source: Binary string: System.Drawing.Primitives.ni.pdbRSDS source: PdfConverters.exe
Source: Binary string: System.Collections.Concurrent.ni.pdb source: PdfConverters.exe
Source: Binary string: System.Runtime.pdb source: PdfConverters.exe, 00000000.00000002.2482519360.000000006F802000.00000020.00000001.01000000.0000000D.sdmp
Source: Binary string: System.ComponentModel.Primitives.ni.pdb source: PdfConverters.exe, System.ComponentModel.Primitives.dll.0.dr
Source: Binary string: /_/artifacts/obj/PresentationFramework.Aero/Release/netcoreapp3.1/PresentationFramework.Aero.pdb,^ source: PresentationFramework.Aero.dll.0.dr
Source: Binary string: System.Reflection.Emit.Lightweight.ni.pdbRSDS& source: System.Reflection.Emit.Lightweight.dll.0.dr
Source: Binary string: Microsoft.VisualBasic.Core.ni.pdb source: PdfConverters.exe
Source: Binary string: System.Diagnostics.StackTrace.ni.pdbRSDSq source: PdfConverters.exe
Source: Binary string: System.IO.Compression.ZipFile.ni.pdb source: PdfConverters.exe, System.IO.Compression.ZipFile.dll.0.dr
Source: Binary string: Microsoft.Win32.Primitives.ni.pdbRSDSR$=iA source: PdfConverters.exe
Source: Binary string: Microsoft.CSharp.ni.pdbRSDSz source: PdfConverters.exe
Source: Binary string: System.Collections.Immutable.pdb7 source: PdfConverters.exe
Source: Binary string: System.Core.ni.pdb source: PdfConverters.exe
Source: Binary string: Accessibility.ni.pdb\Eruntimes/win-x86/lib/netcoreapp3.1/Accessibility.dll source: PdfConverters.exe, 00000000.00000002.2456745883.000000006AFF2000.00000020.00000001.01000000.0000001E.sdmp, Accessibility.dll.0.dr
Source: Binary string: System.Private.Uri.ni.pdbRSDS source: PdfConverters.exe, 00000000.00000002.2456220158.000000006ACF2000.00000020.00000001.01000000.00000025.sdmp
Source: Binary string: System.Diagnostics.Tracing.pdb<2runtimes/win-x86/lib/netcoreapp3.1/System.Diagnostics.Tracing.dll source: PdfConverters.exe, System.Diagnostics.Tracing.dll.0.dr
Source: Binary string: System.IO.MemoryMappedFiles.ni.pdbRSDS source: PdfConverters.exe
Source: Binary string: System.ComponentModel.EventBasedAsync.ni.pdbRSDS source: PdfConverters.exe
Source: Binary string: System.Linq.Expressions.ni.pdb source: PdfConverters.exe
Source: Binary string: System.Diagnostics.Debug.ni.pdbRSDS source: PdfConverters.exe
Source: Binary string: System.Buffers.ni.pdbRSDS source: PdfConverters.exe, System.Buffers.dll.0.dr
Source: Binary string: System.Diagnostics.TraceSource.pdb source: PdfConverters.exe
Source: Binary string: System.Memory.ni.pdb source: PdfConverters.exe, 00000000.00000002.2458498219.000000006B1B2000.00000020.00000001.01000000.00000015.sdmp
Source: Binary string: System.Security.Cryptography.Algorithms.ni.pdb source: System.Security.Cryptography.Algorithms.dll.0.dr
Source: Binary string: System.IO.Pipes.ni.pdb source: PdfConverters.exe
Source: Binary string: System.Threading.Tasks.Parallel.pdbk source: System.Threading.Tasks.Parallel.dll.0.dr
Source: Binary string: System.Threading.Thread.ni.pdb source: PdfConverters.exe, 00000000.00000002.2456830161.000000006B002000.00000020.00000001.01000000.0000001D.sdmp
Source: Binary string: System.Text.Encodings.Web.ni.pdbRSDS source: System.Text.Encodings.Web.dll.0.dr
Source: Binary string: D:\a\_work\1\s\artifacts\obj\win-x86.Release\corehost\cli\hostpolicy\Release\hostpolicy.pdb source: PdfConverters.exe, 00000000.00000002.2481678010.000000006CC1D000.00000002.00000001.01000000.00000008.sdmp
Source: Binary string: System.Diagnostics.FileVersionInfo.ni.pdbRSDSX source: PdfConverters.exe
Source: Binary string: /_/artifacts/obj/System.Windows.Forms/Release/netcoreapp3.1/System.Windows.Forms.pdb source: PdfConverters.exe, 00000000.00000002.2459166964.000000006B6DD000.00000020.00000001.01000000.0000000E.sdmp
Source: Binary string: System.IO.ni.pdb source: PdfConverters.exe
Source: Binary string: System.Runtime.Serialization.ni.pdb source: System.Runtime.Serialization.dll.0.dr
Source: Binary string: System.ComponentModel.ni.pdbRSDS source: PdfConverters.exe
Source: Binary string: System.Configuration.pdb<?runtimes/win-x86/lib/netcoreapp3.1/System.Configuration.dll source: PdfConverters.exe, System.Configuration.dll.0.dr
Source: Binary string: System.Runtime.InteropServices.ni.pdb source: PdfConverters.exe, 00000000.00000002.2482126842.000000006E5A2000.00000020.00000001.01000000.00000012.sdmp, System.Runtime.InteropServices.dll.0.dr
Source: Binary string: System.Runtime.ni.pdbRSDS source: PdfConverters.exe, 00000000.00000002.2482519360.000000006F802000.00000020.00000001.01000000.0000000D.sdmp
Source: Binary string: System.Memory.ni.pdbRSDS source: PdfConverters.exe, 00000000.00000002.2458498219.000000006B1B2000.00000020.00000001.01000000.00000015.sdmp
Source: Binary string: System.Globalization.Calendars.ni.pdbRSDS[)k7#|#E source: PdfConverters.exe
Source: Binary string: System.IO.Pipes.AccessControl.ni.pdb source: PdfConverters.exe
Source: Binary string: System.Diagnostics.Contracts.ni.pdb source: PdfConverters.exe
Source: Binary string: System.Configuration.ni.pdb source: PdfConverters.exe, System.Configuration.dll.0.dr
Source: Binary string: System.IO.FileSystem.ni.pdbRSDSh source: PdfConverters.exe
Source: Binary string: System.Console.ni.pdbRSDS2 source: PdfConverters.exe
Source: Binary string: System.Collections.Immutable.ni.pdbRSDSwDA-C source: PdfConverters.exe
Source: Binary string: api-ms-win-crt-math-l1-1-0.pdb source: api-ms-win-crt-math-l1-1-0.dll.0.dr
Source: Binary string: System.Diagnostics.FileVersionInfo.pdb@_runtimes/win-x86/lib/netcoreapp3.1/System.Diagnostics.FileVersionInfo.dll source: PdfConverters.exe
Source: Binary string: System.Threading.Tasks.ni.pdbRSDS source: PdfConverters.exe, 00000000.00000002.2455544252.000000006AC72000.00000020.00000001.01000000.0000002A.sdmp
Source: Binary string: System.Runtime.InteropServices.RuntimeInformation.ni.pdbRSDS source: System.Runtime.InteropServices.RuntimeInformation.dll.0.dr
Source: Binary string: System.Memory.pdb<h source: PdfConverters.exe, 00000000.00000002.2458498219.000000006B1B2000.00000020.00000001.01000000.00000015.sdmp
Source: Binary string: System.Console.ni.pdb source: PdfConverters.exe
Source: Binary string: System.Diagnostics.Contracts.pdb source: PdfConverters.exe
Source: Binary string: System.IO.FileSystem.AccessControl.ni.pdbRSDS source: PdfConverters.exe
Source: Binary string: System.IO.FileSystem.ni.pdb source: PdfConverters.exe
Source: Binary string: System.IO.IsolatedStorage.pdb source: PdfConverters.exe
Source: Binary string: System.Collections.Specialized.ni.pdbRSDS source: PdfConverters.exe
Source: Binary string: System.IO.FileSystem.AccessControl.ni.pdb source: PdfConverters.exe
Source: Binary string: System.IO.FileSystem.Primitives.pdb source: PdfConverters.exe
Source: Binary string: System.IO.IsolatedStorage.ni.pdbRSDS source: PdfConverters.exe
Source: Binary string: System.Data.Common.ni.pdbRSDS source: PdfConverters.exe
Source: Binary string: System.Globalization.Extensions.ni.pdb source: PdfConverters.exe
Source: Binary string: System.Drawing.Common.ni.pdbRSDS source: PdfConverters.exe, 00000000.00000002.2457159749.000000006B024000.00000020.00000001.01000000.0000001B.sdmp
Source: Binary string: System.Collections.NonGeneric.pdb source: PdfConverters.exe
Source: Binary string: System.Collections.Immutable.pdb source: PdfConverters.exe
Source: Binary string: D:\a\_work\1\s\artifacts\obj\win-x86.Release\corehost\cli\apphost\Release\apphost.pdbiii source: PdfConverters.exe
Source: Binary string: System.Diagnostics.StackTrace.ni.pdb source: PdfConverters.exe
Source: Binary string: System.IO.Compression.FileSystem.ni.pdbRSDS source: PdfConverters.exe
Source: Binary string: System.ni.pdb source: PdfConverters.exe, 00000000.00000002.2455456821.000000006AC62000.00000020.00000001.01000000.0000002B.sdmp
Source: Binary string: System.ComponentModel.pdb source: PdfConverters.exe
Source: Binary string: System.Core.ni.pdbRSDS source: PdfConverters.exe
Source: Binary string: D:\a\_work\1\s\bin\obj\Windows_NT.x86.Release\src\dlls\mscoree\coreclr\Release\coreclr.pdb source: PdfConverters.exe, 00000000.00000002.2481308828.000000006CAF6000.00000002.00000001.01000000.00000009.sdmp
Source: Binary string: Microsoft.Win32.Primitives.ni.pdb source: PdfConverters.exe
Source: Binary string: System.Runtime.Serialization.ni.pdbRSDS source: System.Runtime.Serialization.dll.0.dr
Source: Binary string: System.ComponentModel.Primitives.pdb source: PdfConverters.exe, System.ComponentModel.Primitives.dll.0.dr
Source: Binary string: System.Resources.ResourceManager.ni.pdb source: System.Resources.ResourceManager.dll.0.dr
Source: Binary string: System.Diagnostics.TextWriterTraceListener.pdb source: PdfConverters.exe, System.Diagnostics.TextWriterTraceListener.dll.0.dr
Source: Binary string: System.IO.IsolatedStorage.pdb source: PdfConverters.exe
Source: Binary string: /_/artifacts/obj/PresentationFramework.Aero/Release/netcoreapp3.1/PresentationFramework.Aero.pdb source: PresentationFramework.Aero.dll.0.dr
Source: Binary string: System.IO.Pipes.ni.pdbRSDS\rEv source: PdfConverters.exe
Source: Binary string: Microsoft.VisualBasic.pdb`7runtimes/win-x86/lib/netcoreapp3.1/Microsoft.VisualBasic.dll source: PdfConverters.exe
Source: Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: api-ms-win-crt-filesystem-l1-1-0.dll.0.dr
Source: Binary string: Microsoft.Win32.Registry.ni.pdb source: PdfConverters.exe
Source: Binary string: System.IO.Pipes.AccessControl.ni.pdbRSDS source: PdfConverters.exe
Source: Binary string: System.IO.FileSystem.AccessControl.pdb source: PdfConverters.exe
Source: Binary string: System.IO.pdb source: PdfConverters.exe
Source: Binary string: System.Reflection.Emit.Lightweight.ni.pdb source: System.Reflection.Emit.Lightweight.dll.0.dr
Source: Binary string: System.IO.Compression.Brotli.ni.pdb source: PdfConverters.exe
Source: Binary string: api-ms-win-core-heap-l1-1-0.pdb source: api-ms-win-core-heap-l1-1-0.dll.0.dr
Source: Binary string: D:\a\_work\1\s\artifacts\obj\win-x86.Release\corehost\cli\apphost\Release\apphost.pdb source: PdfConverters.exe
Source: Binary string: System.IO.FileSystem.pdb source: PdfConverters.exe
Source: Binary string: System.Diagnostics.Tracing.ni.pdbRSDSu3 source: PdfConverters.exe, System.Diagnostics.Tracing.dll.0.dr
Source: Binary string: System.Diagnostics.Process.pdb source: PdfConverters.exe
Source: Binary string: System.Collections.Specialized.pdb source: PdfConverters.exe
Source: Binary string: System.Diagnostics.TextWriterTraceListener.ni.pdb source: PdfConverters.exe, System.Diagnostics.TextWriterTraceListener.dll.0.dr
Source: Binary string: System.Diagnostics.Tools.ni.pdbRSDS source: PdfConverters.exe
Source: Binary string: System.Runtime.InteropServices.pdbX source: PdfConverters.exe, 00000000.00000002.2482126842.000000006E5A2000.00000020.00000001.01000000.00000012.sdmp, System.Runtime.InteropServices.dll.0.dr
Source: Binary string: System.AppContext.pdb source: PdfConverters.exe
Source: Binary string: System.Collections.ni.pdb source: PdfConverters.exe
Source: Binary string: System.Private.CoreLib.ni.pdb source: PdfConverters.exe, 00000000.00000002.2477313553.000000006BF65000.00000020.00000001.01000000.0000000A.sdmp
Source: Binary string: System.Diagnostics.TraceSource.ni.pdbRSDS source: PdfConverters.exe
Source: Binary string: D:\a\_work\1\s\third_party\edge_webview2\win\winforms_control\Microsoft.Web.WebView2.WinForms\obj\release\netcoreapp3.0\Microsoft.Web.WebView2.WinForms.pdb@ source: PdfConverters.exe, 00000000.00000002.2451093235.0000000007CE2000.00000002.00000001.01000000.0000001F.sdmp
Source: Binary string: System.Threading.Tasks.ni.pdb source: PdfConverters.exe, 00000000.00000002.2455544252.000000006AC72000.00000020.00000001.01000000.0000002A.sdmp
Source: Binary string: System.IO.UnmanagedMemoryStream.ni.pdbRSDS source: PdfConverters.exe
Source: Binary string: System.IO.pdbt/runtimes/win-x86/lib/netcoreapp3.1/System.IO.dll source: PdfConverters.exe
Source: Binary string: System.Runtime.Serialization.Primitives.pdb source: System.Runtime.Serialization.Primitives.dll.0.dr
Source: Binary string: System.Diagnostics.Contracts.ni.pdbRSDS source: PdfConverters.exe
Source: Binary string: System.Console.pdbP source: PdfConverters.exe
Source: Binary string: Microsoft.CSharp.pdb source: PdfConverters.exe
Source: Binary string: System.Reflection.Emit.Lightweight.pdb source: System.Reflection.Emit.Lightweight.dll.0.dr
Source: Binary string: D:\a\_work\1\s\artifacts\obj\win-x86.Release\corehost\cli\fxr\Release\hostfxr.pdbxxx source: PdfConverters.exe, 00000000.00000002.2481848156.000000006E18E000.00000002.00000001.01000000.00000007.sdmp
Source: Binary string: System.Globalization.Extensions.pdb source: PdfConverters.exe
Source: Binary string: System.Threading.Tasks.Parallel.ni.pdbRSDS source: System.Threading.Tasks.Parallel.dll.0.dr
Source: Binary string: Microsoft.VisualBasic.ni.pdbRSDS# source: PdfConverters.exe
Source: Binary string: System.Configuration.pdb source: PdfConverters.exe, System.Configuration.dll.0.dr
Source: Binary string: System.Data.ni.pdb source: PdfConverters.exe
Source: Binary string: api-ms-win-core-localization-l1-2-0.pdb source: api-ms-win-core-localization-l1-2-0.dll.0.dr
Source: Binary string: System.Threading.Tasks.pdbp4runtimes/win-x86/lib/netcoreapp3.1/System.Threading.Tasks.dll source: PdfConverters.exe, 00000000.00000002.2455544252.000000006AC72000.00000020.00000001.01000000.0000002A.sdmp
Source: Binary string: System.ComponentModel.Primitives.ni.pdbRSDS source: PdfConverters.exe, System.ComponentModel.Primitives.dll.0.dr
Source: Binary string: System.Runtime.Extensions.ni.pdb source: PdfConverters.exe, 00000000.00000002.2457838985.000000006B112000.00000020.00000001.01000000.00000019.sdmp
Source: Binary string: System.Collections.Immutable.ni.pdb source: PdfConverters.exe
Source: Binary string: /_/artifacts/obj/System.Security.Cryptography.ProtectedData/netstandard-Windows_NT-Release/System.Security.Cryptography.ProtectedData.pdbSHA256E\ source: System.Security.Cryptography.ProtectedData.dll.0.dr
Source: Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: api-ms-win-core-processthreads-l1-1-1.dll.0.dr
Source: Binary string: System.IO.UnmanagedMemoryStream.pdb source: PdfConverters.exe
Source: Binary string: D:\a\_work\1\s\third_party\edge_webview2\win\webview2_api_writer\dotNetAPIWrapper\Microsoft.Web.WebView2.Core\bin\ReleasePackage\Microsoft.Web.WebView2.Core.pdb source: PdfConverters.exe, 00000000.00000002.2451625945.0000000007E12000.00000002.00000001.01000000.00000020.sdmp
Source: Binary string: /_/artifacts/obj/System.Drawing.Facade/Release/netcoreapp3.1/System.Drawing.pdb source: PdfConverters.exe, 00000000.00000002.2456367745.000000006AF42000.00000020.00000001.01000000.00000023.sdmp
Source: Binary string: api-ms-win-crt-multibyte-l1-1-0.pdb source: api-ms-win-crt-multibyte-l1-1-0.dll.0.dr
Source: Binary string: System.AppContext.ni.pdb source: PdfConverters.exe
Source: Binary string: System.Diagnostics.DiagnosticSource.ni.pdb source: PdfConverters.exe
Source: Binary string: System.IO.Compression.ni.pdbRSDS source: PdfConverters.exe
Source: Binary string: System.Security.Cryptography.Xml.ni.pdbRSDS source: System.Security.Cryptography.Xml.dll.0.dr
Source: Binary string: Microsoft.Win32.Primitives.pdb source: PdfConverters.exe
Source: Binary string: System.Data.DataSetExtensions.pdb source: PdfConverters.exe
Source: Binary string: System.Dynamic.Runtime.pdb source: PdfConverters.exe, System.Dynamic.Runtime.dll.0.dr
Source: Binary string: Microsoft.Win32.Registry.pdb source: PdfConverters.exe
Source: Binary string: System.Security.Cryptography.Xml.ni.pdb source: System.Security.Cryptography.Xml.dll.0.dr
Source: Binary string: System.Data.DataSetExtensions.ni.pdb source: PdfConverters.exe
Source: Binary string: System.Collections.Concurrent.ni.pdbRSDS source: PdfConverters.exe
Source: Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: api-ms-win-core-interlocked-l1-1-0.dll.0.dr
Source: Binary string: System.Globalization.ni.pdbRSDS source: PdfConverters.exe
Source: Binary string: System.ComponentModel.TypeConverter.pdb,&runtimes/win-x86/lib/netcoreapp3.1/System.ComponentModel.TypeConverter.dll source: PdfConverters.exe
Source: Binary string: Microsoft.CSharp.ni.pdb source: PdfConverters.exe
Source: Binary string: Microsoft.Win32.Registry.pdbX source: PdfConverters.exe
Source: Binary string: System.Text.Encodings.Web.ni.pdb source: System.Text.Encodings.Web.dll.0.dr
Source: Binary string: System.Collections.ni.pdbRSDS source: PdfConverters.exe
Source: Binary string: System.Runtime.ni.pdb source: PdfConverters.exe, 00000000.00000002.2482519360.000000006F802000.00000020.00000001.01000000.0000000D.sdmp
Source: Binary string: System.Reflection.TypeExtensions.pdb source: System.Reflection.TypeExtensions.dll.0.dr
Source: Binary string: System.Security.Cryptography.Algorithms.ni.pdbRSDS source: System.Security.Cryptography.Algorithms.dll.0.dr
Source: Binary string: System.Diagnostics.TraceSource.ni.pdb source: PdfConverters.exe
Source: Binary string: System.IO.Compression.FileSystem.ni.pdb source: PdfConverters.exe
Source: Binary string: System.Data.Common.pdb source: PdfConverters.exe
Source: Binary string: System.Runtime.InteropServices.pdb source: PdfConverters.exe, 00000000.00000002.2482126842.000000006E5A2000.00000020.00000001.01000000.00000012.sdmp, System.Runtime.InteropServices.dll.0.dr
Source: Binary string: System.Diagnostics.Process.ni.pdb source: PdfConverters.exe
Source: Binary string: System.Windows.Forms.ni.pdb source: PdfConverters.exe, 00000000.00000002.2459166964.000000006B6DD000.00000020.00000001.01000000.0000000E.sdmp
Source: Binary string: System.Runtime.InteropServices.RuntimeInformation.pdb source: System.Runtime.InteropServices.RuntimeInformation.dll.0.dr
Source: Binary string: System.Private.Uri.ni.pdb source: PdfConverters.exe, 00000000.00000002.2456220158.000000006ACF2000.00000020.00000001.01000000.00000025.sdmp
Source: Binary string: System.Drawing.ni.pdb source: PdfConverters.exe, 00000000.00000002.2456367745.000000006AF42000.00000020.00000001.01000000.00000023.sdmp
Source: Binary string: System.AppContext.ni.pdbRSDS source: PdfConverters.exe
Source: Binary string: System.IO.Pipes.pdb source: PdfConverters.exe
Source: Binary string: System.IO.FileSystem.Primitives.ni.pdb source: PdfConverters.exe
Source: Binary string: System.Drawing.ni.pdbRSDS source: PdfConverters.exe, 00000000.00000002.2456367745.000000006AF42000.00000020.00000001.01000000.00000023.sdmp
Source: Binary string: System.Runtime.pdb| source: PdfConverters.exe, 00000000.00000002.2482519360.000000006F802000.00000020.00000001.01000000.0000000D.sdmp
Source: Binary string: System.Runtime.InteropServices.ni.pdbRSDS` source: PdfConverters.exe, 00000000.00000002.2482126842.000000006E5A2000.00000020.00000001.01000000.00000012.sdmp, System.Runtime.InteropServices.dll.0.dr
Source: Binary string: System.Dynamic.Runtime.ni.pdbRSDS source: PdfConverters.exe, System.Dynamic.Runtime.dll.0.dr
Source: Binary string: System.Text.Encodings.Web.pdb source: System.Text.Encodings.Web.dll.0.dr
Source: Binary string: api-ms-win-core-util-l1-1-0.pdb source: api-ms-win-core-util-l1-1-0.dll.0.dr
Source: Binary string: System.Collections.NonGeneric.ni.pdb source: PdfConverters.exe
Source: Binary string: System.Diagnostics.Debug.pdb source: PdfConverters.exe
Source: Binary string: System.Diagnostics.DiagnosticSource.pdb source: PdfConverters.exe
Source: Binary string: System.Windows.Forms.ni.pdbRSDS source: PdfConverters.exe, 00000000.00000002.2459166964.000000006B6DD000.00000020.00000001.01000000.0000000E.sdmp
Source: Binary string: System.Resources.ResourceManager.ni.pdbRSDS source: System.Resources.ResourceManager.dll.0.dr
Source: Binary string: System.Linq.Expressions.pdb source: PdfConverters.exe
Source: Binary string: System.Globalization.Extensions.ni.pdbRSDS^ source: PdfConverters.exe
Source: Binary string: D:\a\_work\1\s\artifacts\obj\win-x86.Release\corehost\cli\hostpolicy\Release\hostpolicy.pdbvvv source: PdfConverters.exe, 00000000.00000002.2481678010.000000006CC1D000.00000002.00000001.01000000.00000008.sdmp
Source: Binary string: /_/artifacts/obj/System.Security.Cryptography.ProtectedData/netstandard-Windows_NT-Release/System.Security.Cryptography.ProtectedData.pdb source: System.Security.Cryptography.ProtectedData.dll.0.dr
Source: Binary string: System.Private.CoreLib.pdbD[ source: PdfConverters.exe, 00000000.00000002.2477313553.000000006BF65000.00000020.00000001.01000000.0000000A.sdmp
Source: Binary string: System.Collections.Concurrent.pdb source: PdfConverters.exe
Source: Binary string: System.IO.Compression.ni.pdb source: PdfConverters.exe
Source: Binary string: System.IO.Compression.FileSystem.pdb<.runtimes/win-x86/lib/netcoreapp3.1/System.IO.Compression.FileSystem.dll source: PdfConverters.exe
Source: Binary string: System.Diagnostics.Tracing.pdb source: PdfConverters.exe, System.Diagnostics.Tracing.dll.0.dr
Source: Binary string: System.Resources.ResourceManager.pdb<0runtimes/win-x86/lib/netcoreapp3.1/System.Resources.ResourceManager.dll source: System.Resources.ResourceManager.dll.0.dr
Source: Binary string: System.ComponentModel.TypeConverter.ni.pdb source: PdfConverters.exe
Source: Binary string: D:\a\_work\1\s\artifacts\obj\win-x86.Release\corehost\cli\fxr\Release\hostfxr.pdb source: PdfConverters.exe, 00000000.00000002.2481848156.000000006E18E000.00000002.00000001.01000000.00000007.sdmp
Source: Binary string: System.IO.IsolatedStorage.ni.pdb source: PdfConverters.exe
Source: Binary string: System.Threading.Tasks.Parallel.pdb source: System.Threading.Tasks.Parallel.dll.0.dr
Source: Binary string: System.Threading.ni.pdbRSDSHV source: PdfConverters.exe, 00000000.00000002.2458725706.000000006B1E2000.00000020.00000001.01000000.00000014.sdmp, System.Threading.dll.0.dr
Source: Binary string: System.ni.pdbRSDS source: PdfConverters.exe, 00000000.00000002.2455456821.000000006AC62000.00000020.00000001.01000000.0000002B.sdmp
Source: Binary string: System.Runtime.Extensions.pdb source: PdfConverters.exe, 00000000.00000002.2457838985.000000006B112000.00000020.00000001.01000000.00000019.sdmp
Source: Binary string: System.Diagnostics.Debug.ni.pdb source: PdfConverters.exe
Source: Binary string: System.Private.CoreLib.pdb source: PdfConverters.exe, 00000000.00000002.2477313553.000000006BF65000.00000020.00000001.01000000.0000000A.sdmp
Source: Binary string: Microsoft.Win32.Registry.ni.pdbRSDSA source: PdfConverters.exe
Source: Binary string: /_/artifacts/obj/System.Drawing.Common/netcoreapp3.0-Windows_NT-Release/System.Drawing.Common.pdbSHA256 source: PdfConverters.exe, 00000000.00000002.2457159749.000000006B024000.00000020.00000001.01000000.0000001B.sdmp
Source: Binary string: Microsoft.Win32.SystemEvents.ni.pdb source: PdfConverters.exe, 00000000.00000002.2455761226.000000006AC92000.00000020.00000001.01000000.00000028.sdmp
Source: Binary string: System.Resources.ResourceManager.pdb source: System.Resources.ResourceManager.dll.0.dr
Source: Binary string: System.Xml.XmlSerializer.pdb source: System.Xml.XmlSerializer.dll.0.dr
Source: Binary string: /_/artifacts/obj/System.Security.Cryptography.Xml/netstandard-Release/System.Security.Cryptography.Xml.pdbSHA256 source: System.Security.Cryptography.Xml.dll.0.dr
Source: Binary string: System.IO.FileSystem.DriveInfo.pdb source: PdfConverters.exe
Source: Binary string: System.Security.Cryptography.Algorithms.pdb source: System.Security.Cryptography.Algorithms.dll.0.dr
Source: Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: api-ms-win-crt-conio-l1-1-0.dll.0.dr
Source: Binary string: System.Globalization.ni.pdb source: PdfConverters.exe
Source: Binary string: System.IO.FileSystem.Primitives.ni.pdbRSDS source: PdfConverters.exe
Source: Binary string: System.Runtime.InteropServices.RuntimeInformation.ni.pdb source: System.Runtime.InteropServices.RuntimeInformation.dll.0.dr
Source: Binary string: System.pdb source: PdfConverters.exe, 00000000.00000002.2455456821.000000006AC62000.00000020.00000001.01000000.0000002B.sdmp
Source: Binary string: System.IO.FileSystem.Watcher.ni.pdbRSDS% source: PdfConverters.exe
Source: Binary string: System.Globalization.Calendars.ni.pdb source: PdfConverters.exe
Source: Binary string: System.IO.FileSystem.Watcher.ni.pdb source: PdfConverters.exe
Source: Binary string: /_/artifacts/obj/Microsoft.Win32.SystemEvents/netcoreapp3.0-Windows_NT-Release/Microsoft.Win32.SystemEvents.pdbSHA256 source: PdfConverters.exe, 00000000.00000002.2455761226.000000006AC92000.00000020.00000001.01000000.00000028.sdmp
Source: Binary string: miutils.pdb source: miutils.dll.0.dr
Source: Binary string: System.ComponentModel.TypeConverter.ni.pdbRSDS source: PdfConverters.exe
Source: Binary string: System.Security.Cryptography.ProtectedData.ni.pdb source: System.Security.Cryptography.ProtectedData.dll.0.dr
Source: Binary string: System.IO.Compression.ZipFile.pdb source: PdfConverters.exe, System.IO.Compression.ZipFile.dll.0.dr
Source: Binary string: System.Dynamic.Runtime.ni.pdb source: PdfConverters.exe, System.Dynamic.Runtime.dll.0.dr
Source: Binary string: System.Core.pdb source: PdfConverters.exe
Source: Binary string: System.IO.Pipes.AccessControl.pdb source: PdfConverters.exe
Source: Binary string: System.Collections.pdb,E source: PdfConverters.exe
Source: Binary string: Microsoft.Win32.SystemEvents.ni.pdbRSDS source: PdfConverters.exe, 00000000.00000002.2455761226.000000006AC92000.00000020.00000001.01000000.00000028.sdmp
Source: Binary string: System.Diagnostics.StackTrace.pdb source: PdfConverters.exe
Source: Binary string: System.Data.Common.ni.pdb source: PdfConverters.exe
Source: Binary string: System.Security.Cryptography.ProtectedData.ni.pdbRSDSE\ source: System.Security.Cryptography.ProtectedData.dll.0.dr
Source: Binary string: System.Threading.Thread.ni.pdbRSDS source: PdfConverters.exe, 00000000.00000002.2456830161.000000006B002000.00000020.00000001.01000000.0000001D.sdmp
Source: Binary string: System.IO.Compression.FileSystem.pdb source: PdfConverters.exe
Source: Binary string: Microsoft.VisualBasic.Core.pdb source: PdfConverters.exe
Source: Binary string: System.Diagnostics.FileVersionInfo.pdb source: PdfConverters.exe
Source: Binary string: System.Private.Uri.pdb source: PdfConverters.exe, 00000000.00000002.2456220158.000000006ACF2000.00000020.00000001.01000000.00000025.sdmp
Source: Binary string: System.Data.ni.pdbRSDS! source: PdfConverters.exe
Source: Binary string: D:\a\_work\1\s\third_party\edge_webview2\win\webview2_api_writer\dotNetAPIWrapper\Microsoft.Web.WebView2.Core\bin\ReleasePackage\Microsoft.Web.WebView2.Core.pdb@% source: PdfConverters.exe, 00000000.00000002.2451625945.0000000007E12000.00000002.00000001.01000000.00000020.sdmp
Source: Binary string: System.Xml.XmlSerializer.ni.pdbRSDS source: System.Xml.XmlSerializer.dll.0.dr
Source: PdfConverters.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: PdfConverters.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: PdfConverters.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: PdfConverters.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: PdfConverters.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Binary contains a suspicious time stamp
Source: app.dll.0.dr Static PE information: 0xE0B2B334 [Fri Jun 17 00:47:48 2089 UTC]
PE file contains sections with non-standard names
Source: WebView2Loader.dll.0.dr Static PE information: section name: .00cfg
Source: Microsoft.CSharp.dll.0.dr Static PE information: section name: .text entropy: 6.850957897378654
Drops PE files
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\de\System.Windows.Forms.Design.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\tr\ReachFramework.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ko\System.Windows.Input.Manipulations.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\Accessibility.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pl\UIAutomationClient.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ru\UIAutomationClientSideProviders.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Net.Requests.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\es\PresentationUI.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ru\WindowsFormsIntegration.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Text.Json.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Private.CoreLib.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.IO.Packaging.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Transactions.Local.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Numerics.Vectors.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Threading.Channels.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Security.Cryptography.OpenSsl.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hans\System.Windows.Forms.Design.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Configuration.ConfigurationManager.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Windows.Forms.Design.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\es\UIAutomationProvider.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Threading.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\tr\PresentationFramework.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Runtime.InteropServices.WindowsRuntime.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Diagnostics.Process.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Diagnostics.DiagnosticSource.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-core-processthreads-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pl\PresentationCore.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\de\ReachFramework.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pl\PresentationUI.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.IO.FileSystem.Primitives.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-crt-time-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Runtime.InteropServices.RuntimeInformation.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Xml.Serialization.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pl\Microsoft.CodeAnalysis.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\PresentationFramework.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Windows.Presentation.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\WindowsFormsIntegration.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\Microsoft.Web.WebView2.WinForms.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Runtime.Handles.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ko\PresentationUI.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pl\WindowsFormsIntegration.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hans\System.Windows.Controls.Ribbon.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-crt-math-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ja\UIAutomationClientSideProviders.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ja\System.Windows.Forms.Design.Editors.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Security.Cryptography.Cng.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-core-namedpipe-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\cs\System.Windows.Input.Manipulations.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hant\System.Windows.Controls.Ribbon.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\cs\PresentationFramework.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.ComponentModel.TypeConverter.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-core-profile-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ko\System.Windows.Forms.Design.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\fr\Microsoft.CodeAnalysis.CSharp.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Windows.Extensions.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pt-BR\PresentationFramework.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Threading.Thread.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ucrtbase.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\cs\System.Windows.Forms.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pl\PresentationFramework.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\UIAutomationTypes.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Runtime.Serialization.Xml.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ko\UIAutomationClient.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\es\Microsoft.CodeAnalysis.CSharp.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hant\WindowsFormsIntegration.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\cs\UIAutomationProvider.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\Microsoft.VisualBasic.Core.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-core-synch-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Net.Security.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\it\PresentationUI.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Security.Cryptography.X509Certificates.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ja\System.Xaml.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.IO.Compression.Brotli.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ja\WindowsBase.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\tr\WindowsBase.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\cs\WindowsBase.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\Microsoft.Management.Infrastructure.Native.Unmanaged.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\cs\System.Xaml.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Xaml.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Net.WebHeaderCollection.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Security.Cryptography.Encoding.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hant\UIAutomationClientSideProviders.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.CodeDom.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ja\UIAutomationTypes.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\runtimes\win-x86\native\WebView2Loader.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hans\System.Windows.Forms.Design.Editors.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pl\WindowsBase.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\mscordaccore_x86_x86_4.700.22.55902.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pt-BR\System.Windows.Input.Manipulations.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\cs\System.Windows.Controls.Ribbon.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pt-BR\Microsoft.CodeAnalysis.CSharp.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ko\PresentationCore.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-core-sysinfo-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\clrjit.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\es\System.Windows.Input.Manipulations.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-core-libraryloader-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-core-processthreads-l1-1-1.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hant\UIAutomationProvider.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\PresentationFramework.Luna.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\it\System.Windows.Controls.Ribbon.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\fr\WindowsFormsIntegration.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\tr\UIAutomationTypes.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\it\PresentationFramework.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Net.Ping.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\cs\System.Windows.Forms.Design.Editors.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hant\Microsoft.CodeAnalysis.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\fr\System.Xaml.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ru\UIAutomationClient.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-core-file-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ja\System.Windows.Forms.Design.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pt-BR\Microsoft.CodeAnalysis.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\Microsoft.Management.Infrastructure.Native.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Diagnostics.EventLog.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\de\UIAutomationClient.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Linq.Parallel.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\tr\WindowsFormsIntegration.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pt-BR\PresentationCore.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.ComponentModel.Primitives.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Runtime.Numerics.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hant\UIAutomationClient.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\API-MS-Win-core-xstate-l2-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pl\System.Windows.Forms.Design.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-core-memory-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\it\UIAutomationProvider.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Linq.Queryable.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\es\System.Xaml.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ru\System.Windows.Forms.Design.Editors.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-crt-locale-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.AppContext.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pl\System.Windows.Forms.Design.Editors.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Diagnostics.TraceSource.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\PresentationFramework.AeroLite.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\miutils.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\de\System.Windows.Input.Manipulations.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\de\UIAutomationTypes.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.IO.UnmanagedMemoryStream.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Net.Primitives.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ja\ReachFramework.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\PresentationFramework-SystemCore.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hant\ReachFramework.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\DirectWriteForwarder.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ja\WindowsFormsIntegration.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\es\UIAutomationClient.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Security.SecureString.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\it\System.Windows.Forms.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Runtime.Serialization.Formatters.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\PresentationFramework.Aero2.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\UIAutomationProvider.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pl\System.Windows.Forms.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ko\System.Windows.Controls.Ribbon.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Diagnostics.PerformanceCounter.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\PresentationFramework-SystemXml.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\mscorrc.debug.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-core-datetime-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Data.DataSetExtensions.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-crt-runtime-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\WebView2Loader.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Runtime.InteropServices.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Configuration.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pl\ReachFramework.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hans\UIAutomationTypes.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hans\PresentationUI.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hans\Microsoft.CodeAnalysis.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ko\System.Windows.Forms.Design.Editors.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ko\Microsoft.CodeAnalysis.CSharp.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\fr\UIAutomationTypes.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\es\ReachFramework.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\Microsoft.Management.Infrastructure.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\Microsoft.VisualBasic.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\cs\UIAutomationClient.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\Microsoft.DiaSymReader.Native.x86.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pt-BR\UIAutomationTypes.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\fr\System.Windows.Forms.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Net.Sockets.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Buffers.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-crt-stdio-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Xml.XDocument.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\es\System.Windows.Forms.Design.Editors.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ru\WindowsBase.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Xml.Linq.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pl\UIAutomationClientSideProviders.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pl\System.Xaml.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\hostfxr.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-core-heap-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\Microsoft.Web.WebView2.Wpf.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Runtime.Serialization.Primitives.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\tr\System.Windows.Forms.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pt-BR\System.Windows.Forms.Design.Editors.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\de\Microsoft.CodeAnalysis.CSharp.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Design.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ru\System.Xaml.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.ComponentModel.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\it\Microsoft.CodeAnalysis.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Security.Claims.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Runtime.WindowsRuntime.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.IO.FileSystem.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.IO.Pipes.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.ComponentModel.Annotations.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Security.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Xml.XPath.XDocument.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\tr\System.Windows.Controls.Ribbon.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.DirectoryServices.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\cs\Microsoft.CodeAnalysis.CSharp.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.IO.MemoryMappedFiles.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\es\UIAutomationTypes.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-crt-filesystem-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\fr\PresentationCore.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Text.Encoding.Extensions.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\fr\UIAutomationProvider.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Drawing.Design.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Globalization.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Diagnostics.StackTrace.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-core-timezone-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hant\System.Windows.Forms.Design.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Threading.Tasks.Parallel.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\de\PresentationCore.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pt-BR\WindowsBase.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hant\WindowsBase.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Net.WebSockets.Client.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Threading.Tasks.Dataflow.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.IO.Compression.ZipFile.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pl\UIAutomationProvider.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\de\PresentationUI.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\it\System.Xaml.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ko\WindowsFormsIntegration.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\PresentationFramework.Royale.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pt-BR\UIAutomationClientSideProviders.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ru\UIAutomationTypes.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Diagnostics.Contracts.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ru\System.Windows.Forms.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pt-BR\WindowsFormsIntegration.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\fr\WindowsBase.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Net.HttpListener.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ReachFramework.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ru\UIAutomationProvider.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\PresentationNative_cor3.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ru\PresentationFramework.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.ServiceModel.Web.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.IO.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Resources.Extensions.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Security.Cryptography.Xml.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Collections.Immutable.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\cs\Microsoft.CodeAnalysis.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\it\Microsoft.CodeAnalysis.CSharp.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Security.AccessControl.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-crt-private-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-core-file-l2-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-core-processenvironment-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hant\PresentationUI.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\it\WindowsFormsIntegration.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-core-synch-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Collections.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\de\System.Windows.Controls.Ribbon.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Threading.Tasks.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\es\PresentationCore.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ja\System.Windows.Controls.Ribbon.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\de\WindowsBase.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-crt-conio-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\it\System.Windows.Input.Manipulations.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-crt-environment-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Xml.ReaderWriter.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\cs\ReachFramework.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-core-handle-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Windows.Forms.Design.Editors.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ja\Microsoft.CodeAnalysis.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ko\System.Xaml.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hans\ReachFramework.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ko\System.Windows.Forms.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ko\UIAutomationTypes.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Diagnostics.Debug.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ru\Microsoft.CodeAnalysis.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\de\System.Xaml.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\Microsoft.Web.WebView2.Core.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ru\ReachFramework.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\UIAutomationClientSideProviders.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\cs\PresentationCore.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\vcruntime140_cor3.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ru\System.Windows.Forms.Design.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ru\System.Windows.Input.Manipulations.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\es\PresentationFramework.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\PresentationFramework-SystemDrawing.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\tr\Microsoft.CodeAnalysis.CSharp.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Security.Permissions.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\PresentationUI.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Security.Principal.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.IO.FileSystem.AccessControl.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Data.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Drawing.Primitives.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-crt-process-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Transactions.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\coreclr.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ko\WindowsBase.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\it\WindowsBase.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Core.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Runtime.Intrinsics.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-core-errorhandling-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\it\UIAutomationClient.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\tr\UIAutomationClientSideProviders.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pl\Microsoft.CodeAnalysis.CSharp.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\fr\System.Windows.Controls.Ribbon.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\mi.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-crt-string-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Drawing.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Security.Cryptography.Pkcs.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hant\System.Windows.Input.Manipulations.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\clretwrc.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\D3DCompiler_47_cor3.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ja\UIAutomationClient.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.ComponentModel.EventBasedAsync.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ru\PresentationCore.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Diagnostics.FileVersionInfo.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\es\Microsoft.CodeAnalysis.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\PresentationFramework.Classic.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\hostpolicy.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Text.Encoding.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\app.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Windows.Forms.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hans\System.Windows.Input.Manipulations.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\it\UIAutomationClientSideProviders.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pt-BR\PresentationUI.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Net.WebProxy.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Security.Cryptography.Csp.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Globalization.Extensions.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.IO.Compression.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Net.NetworkInformation.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ru\Microsoft.CodeAnalysis.CSharp.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\tr\UIAutomationProvider.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.IO.FileSystem.Watcher.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ja\PresentationFramework.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Web.HttpUtility.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ko\PresentationFramework.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hant\System.Xaml.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\clrcompression.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\cs\PresentationUI.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pt-BR\System.Windows.Controls.Ribbon.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\tr\UIAutomationClient.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-core-util-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pt-BR\System.Xaml.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Diagnostics.Tracing.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\fr\System.Windows.Input.Manipulations.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\WindowsBase.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\mscorrc.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\Newtonsoft.Json.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Net.WebClient.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\cs\System.Windows.Forms.Design.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Console.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Threading.Tasks.Extensions.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ru\PresentationUI.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.ServiceProcess.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-core-file-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Globalization.Calendars.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\mscordaccore.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\de\System.Windows.Forms.Design.Editors.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Web.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\fr\Microsoft.CodeAnalysis.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-core-string-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Net.Http.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Xml.XmlDocument.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\dbgshim.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\PresentationFramework-SystemXmlLinq.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pl\UIAutomationTypes.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\it\System.Windows.Forms.Design.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hans\UIAutomationClientSideProviders.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\cs\UIAutomationClientSideProviders.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\tr\System.Windows.Input.Manipulations.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Security.Cryptography.ProtectedData.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hant\System.Windows.Forms.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\Microsoft.Win32.Registry.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\it\UIAutomationTypes.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\de\Microsoft.CodeAnalysis.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-core-interlocked-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\PenImc_cor3.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\fr\PresentationFramework.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\Microsoft.CodeAnalysis.CSharp.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Threading.Timer.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-crt-heap-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.ValueTuple.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Runtime.WindowsRuntime.UI.Xaml.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\Microsoft.Win32.SystemEvents.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hant\Microsoft.CodeAnalysis.CSharp.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pl\System.Windows.Input.Manipulations.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\UIAutomationClient.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Xml.XmlSerializer.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Net.ServicePoint.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Diagnostics.TextWriterTraceListener.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\es\System.Windows.Controls.Ribbon.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.IO.IsolatedStorage.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-crt-utility-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Printing.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hant\PresentationFramework.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ko\ReachFramework.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\de\PresentationFramework.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Runtime.Loader.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Xml.XPath.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Collections.NonGeneric.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\Microsoft.CSharp.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.IO.Pipes.AccessControl.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\it\System.Windows.Forms.Design.Editors.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ko\UIAutomationClientSideProviders.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hans\PresentationCore.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\fr\UIAutomationClient.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Net.NameResolution.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hans\System.Xaml.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Threading.AccessControl.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hans\System.Windows.Forms.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\tr\Microsoft.CodeAnalysis.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\tr\PresentationUI.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Text.RegularExpressions.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hant\PresentationCore.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Collections.Specialized.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Runtime.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Security.Principal.Windows.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hans\PresentationFramework.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\cs\WindowsFormsIntegration.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\es\WindowsFormsIntegration.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pt-BR\ReachFramework.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\fr\ReachFramework.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\wpfgfx_cor3.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hant\UIAutomationTypes.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Xml.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Diagnostics.Tools.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ja\System.Windows.Input.Manipulations.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\mscorlib.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hans\UIAutomationProvider.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ru\System.Windows.Controls.Ribbon.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Net.WebSockets.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ja\Microsoft.CodeAnalysis.CSharp.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\fr\System.Windows.Forms.Design.Editors.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Threading.Overlapped.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ja\PresentationCore.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Dynamic.Runtime.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\it\ReachFramework.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ja\UIAutomationProvider.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\es\System.Windows.Forms.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\de\WindowsFormsIntegration.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\tr\System.Windows.Forms.Design.Editors.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\de\UIAutomationClientSideProviders.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Windows.Input.Manipulations.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Runtime.Serialization.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ja\System.Windows.Forms.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\tr\System.Xaml.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Net.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ko\UIAutomationProvider.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\fr\PresentationUI.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-crt-convert-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.IO.Compression.FileSystem.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Collections.Concurrent.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Memory.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\cs\UIAutomationTypes.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-core-console-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Net.Mail.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\PresentationFramework.Aero.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\es\System.Windows.Forms.Design.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hans\UIAutomationClient.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\fr\System.Windows.Forms.Design.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\tr\System.Windows.Forms.Design.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ko\Microsoft.CodeAnalysis.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Linq.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Security.Cryptography.Primitives.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Runtime.Serialization.Json.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\es\WindowsBase.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\it\PresentationCore.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Data.Common.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\es\UIAutomationClientSideProviders.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pl\System.Windows.Controls.Ribbon.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-crt-multibyte-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.ComponentModel.DataAnnotations.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hans\WindowsFormsIntegration.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-core-localization-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\fr\UIAutomationClientSideProviders.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pt-BR\UIAutomationProvider.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Drawing.Common.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\mscordbi.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.IO.FileSystem.DriveInfo.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Windows.Controls.Ribbon.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Runtime.Extensions.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ja\PresentationUI.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Windows.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hant\System.Windows.Forms.Design.Editors.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Threading.ThreadPool.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hans\Microsoft.CodeAnalysis.CSharp.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hans\WindowsBase.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Text.Encodings.Web.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-core-debug-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Linq.Expressions.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pt-BR\System.Windows.Forms.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\Microsoft.Win32.Registry.AccessControl.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\Microsoft.Win32.Primitives.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\Microsoft.CodeAnalysis.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\de\System.Windows.Forms.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Security.Cryptography.Algorithms.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-core-rtlsupport-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pt-BR\UIAutomationClient.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\PresentationFramework-SystemData.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\netstandard.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\de\UIAutomationProvider.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Text.Encoding.CodePages.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pt-BR\System.Windows.Forms.Design.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe File created: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\tr\PresentationCore.resources.dll Jump to dropped file
Stores files to the Windows start menu directory
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process information set: NOOPENFILEERRORBOX
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\PdfConverters.exe Memory allocated: 4AE0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Memory allocated: 4D80000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Memory allocated: 6D80000 memory reserve | memory write watch Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\PdfConverters.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\tr\ReachFramework.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\de\System.Windows.Forms.Design.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ko\System.Windows.Input.Manipulations.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\Accessibility.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ru\UIAutomationClientSideProviders.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pl\UIAutomationClient.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Net.Requests.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ru\WindowsFormsIntegration.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\es\PresentationUI.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Text.Json.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Private.CoreLib.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.IO.Packaging.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Transactions.Local.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Numerics.Vectors.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Reflection.Extensions.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Threading.Channels.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Security.Cryptography.OpenSsl.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hans\System.Windows.Forms.Design.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Configuration.ConfigurationManager.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\es\UIAutomationProvider.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Windows.Forms.Design.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Threading.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\tr\PresentationFramework.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Runtime.InteropServices.WindowsRuntime.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Diagnostics.Process.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-core-processthreads-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Diagnostics.DiagnosticSource.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pl\PresentationCore.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\de\ReachFramework.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Reflection.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pl\PresentationUI.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.IO.FileSystem.Primitives.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-crt-time-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Runtime.InteropServices.RuntimeInformation.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Xml.Serialization.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pl\Microsoft.CodeAnalysis.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\PresentationFramework.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Windows.Presentation.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\WindowsFormsIntegration.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\Microsoft.Web.WebView2.WinForms.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Runtime.Handles.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ko\PresentationUI.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pl\WindowsFormsIntegration.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-crt-math-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hans\System.Windows.Controls.Ribbon.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ja\UIAutomationClientSideProviders.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ja\System.Windows.Forms.Design.Editors.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-core-namedpipe-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Security.Cryptography.Cng.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\cs\System.Windows.Input.Manipulations.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hant\System.Windows.Controls.Ribbon.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.ComponentModel.TypeConverter.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\cs\PresentationFramework.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-core-profile-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ko\System.Windows.Forms.Design.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\fr\Microsoft.CodeAnalysis.CSharp.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Windows.Extensions.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pt-BR\PresentationFramework.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Threading.Thread.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pl\PresentationFramework.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\cs\System.Windows.Forms.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\UIAutomationTypes.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Runtime.Serialization.Xml.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Runtime.CompilerServices.Unsafe.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ko\UIAutomationClient.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\es\Microsoft.CodeAnalysis.CSharp.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hant\WindowsFormsIntegration.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\cs\UIAutomationProvider.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\Microsoft.VisualBasic.Core.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Net.Security.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-core-synch-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\it\PresentationUI.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Security.Cryptography.X509Certificates.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ja\System.Xaml.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Reflection.Emit.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.IO.Compression.Brotli.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ja\WindowsBase.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\tr\WindowsBase.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\cs\WindowsBase.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\Microsoft.Management.Infrastructure.Native.Unmanaged.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\cs\System.Xaml.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Xaml.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Net.WebHeaderCollection.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Security.Cryptography.Encoding.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.CodeDom.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hant\UIAutomationClientSideProviders.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ja\UIAutomationTypes.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\runtimes\win-x86\native\WebView2Loader.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hans\System.Windows.Forms.Design.Editors.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pl\WindowsBase.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\mscordaccore_x86_x86_4.700.22.55902.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pt-BR\System.Windows.Input.Manipulations.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\cs\System.Windows.Controls.Ribbon.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pt-BR\Microsoft.CodeAnalysis.CSharp.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ko\PresentationCore.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-core-sysinfo-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\es\System.Windows.Input.Manipulations.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\clrjit.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-core-libraryloader-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-core-processthreads-l1-1-1.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hant\UIAutomationProvider.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\PresentationFramework.Luna.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\it\System.Windows.Controls.Ribbon.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\fr\WindowsFormsIntegration.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\tr\UIAutomationTypes.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Net.Ping.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\it\PresentationFramework.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\cs\System.Windows.Forms.Design.Editors.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hant\Microsoft.CodeAnalysis.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\fr\System.Xaml.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ru\UIAutomationClient.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-core-file-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ja\System.Windows.Forms.Design.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pt-BR\Microsoft.CodeAnalysis.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\Microsoft.Management.Infrastructure.Native.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Diagnostics.EventLog.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Linq.Parallel.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\de\UIAutomationClient.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pt-BR\PresentationCore.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\tr\WindowsFormsIntegration.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.ComponentModel.Primitives.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Runtime.Numerics.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hant\UIAutomationClient.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\API-MS-Win-core-xstate-l2-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pl\System.Windows.Forms.Design.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-core-memory-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\it\UIAutomationProvider.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Linq.Queryable.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Reflection.Emit.Lightweight.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\es\System.Xaml.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ru\System.Windows.Forms.Design.Editors.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-crt-locale-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.AppContext.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pl\System.Windows.Forms.Design.Editors.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Diagnostics.TraceSource.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\PresentationFramework.AeroLite.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\miutils.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\de\System.Windows.Input.Manipulations.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\de\UIAutomationTypes.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Net.Primitives.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.IO.UnmanagedMemoryStream.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ja\ReachFramework.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\PresentationFramework-SystemCore.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hant\ReachFramework.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\DirectWriteForwarder.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ja\WindowsFormsIntegration.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Security.SecureString.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\es\UIAutomationClient.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\it\System.Windows.Forms.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Runtime.Serialization.Formatters.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\PresentationFramework.Aero2.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\UIAutomationProvider.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pl\System.Windows.Forms.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ko\System.Windows.Controls.Ribbon.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Diagnostics.PerformanceCounter.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\PresentationFramework-SystemXml.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-core-datetime-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\mscorrc.debug.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Data.DataSetExtensions.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Resources.Writer.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-crt-runtime-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Runtime.InteropServices.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Configuration.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\WebView2Loader.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pl\ReachFramework.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hans\UIAutomationTypes.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hans\PresentationUI.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hans\Microsoft.CodeAnalysis.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ko\System.Windows.Forms.Design.Editors.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ko\Microsoft.CodeAnalysis.CSharp.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\fr\UIAutomationTypes.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\es\ReachFramework.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\Microsoft.Management.Infrastructure.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\Microsoft.VisualBasic.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\Microsoft.DiaSymReader.Native.x86.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\cs\UIAutomationClient.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pt-BR\UIAutomationTypes.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\fr\System.Windows.Forms.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Net.Sockets.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Buffers.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-crt-stdio-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Xml.XDocument.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\es\System.Windows.Forms.Design.Editors.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ru\WindowsBase.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Xml.Linq.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pl\UIAutomationClientSideProviders.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pl\System.Xaml.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\hostfxr.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-core-heap-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\Microsoft.Web.WebView2.Wpf.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Runtime.Serialization.Primitives.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\tr\System.Windows.Forms.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pt-BR\System.Windows.Forms.Design.Editors.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\de\Microsoft.CodeAnalysis.CSharp.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Design.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ru\System.Xaml.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.ComponentModel.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\it\Microsoft.CodeAnalysis.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Security.Claims.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Runtime.WindowsRuntime.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.IO.FileSystem.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.IO.Pipes.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Security.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.ComponentModel.Annotations.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Xml.XPath.XDocument.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\tr\System.Windows.Controls.Ribbon.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.DirectoryServices.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.IO.MemoryMappedFiles.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\cs\Microsoft.CodeAnalysis.CSharp.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-crt-filesystem-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\es\UIAutomationTypes.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\fr\PresentationCore.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Text.Encoding.Extensions.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\fr\UIAutomationProvider.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Drawing.Design.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Globalization.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Diagnostics.StackTrace.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-core-timezone-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hant\System.Windows.Forms.Design.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Threading.Tasks.Parallel.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\de\PresentationCore.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pt-BR\WindowsBase.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hant\WindowsBase.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Net.WebSockets.Client.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Threading.Tasks.Dataflow.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.IO.Compression.ZipFile.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pl\UIAutomationProvider.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\de\PresentationUI.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\it\System.Xaml.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ko\WindowsFormsIntegration.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\PresentationFramework.Royale.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pt-BR\UIAutomationClientSideProviders.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ru\UIAutomationTypes.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Diagnostics.Contracts.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ru\System.Windows.Forms.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pt-BR\WindowsFormsIntegration.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\fr\WindowsBase.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Net.HttpListener.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Private.Xml.Linq.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ReachFramework.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ru\UIAutomationProvider.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\PresentationNative_cor3.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ru\PresentationFramework.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.IO.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.ServiceModel.Web.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Reflection.TypeExtensions.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Resources.Extensions.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Security.Cryptography.Xml.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Collections.Immutable.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\cs\Microsoft.CodeAnalysis.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\it\Microsoft.CodeAnalysis.CSharp.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Security.AccessControl.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-crt-private-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-core-file-l2-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-core-processenvironment-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hant\PresentationUI.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Private.DataContractSerialization.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\it\WindowsFormsIntegration.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-core-synch-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Collections.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\de\System.Windows.Controls.Ribbon.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Threading.Tasks.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\es\PresentationCore.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ja\System.Windows.Controls.Ribbon.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\de\WindowsBase.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-crt-conio-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\it\System.Windows.Input.Manipulations.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-crt-environment-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Xml.ReaderWriter.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\cs\ReachFramework.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-core-handle-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Windows.Forms.Design.Editors.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ja\Microsoft.CodeAnalysis.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ko\System.Xaml.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hans\ReachFramework.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ko\System.Windows.Forms.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ko\UIAutomationTypes.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Diagnostics.Debug.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ru\Microsoft.CodeAnalysis.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\de\System.Xaml.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\UIAutomationClientSideProviders.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\Microsoft.Web.WebView2.Core.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ru\ReachFramework.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Resources.Reader.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\cs\PresentationCore.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\vcruntime140_cor3.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ru\System.Windows.Forms.Design.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ru\System.Windows.Input.Manipulations.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\es\PresentationFramework.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\PresentationFramework-SystemDrawing.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Security.Permissions.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\tr\Microsoft.CodeAnalysis.CSharp.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\PresentationUI.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Security.Principal.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.IO.FileSystem.AccessControl.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Data.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Drawing.Primitives.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Transactions.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-crt-process-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\coreclr.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ko\WindowsBase.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\it\WindowsBase.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Core.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Runtime.Intrinsics.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-core-errorhandling-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Private.Uri.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\tr\UIAutomationClientSideProviders.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\it\UIAutomationClient.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pl\Microsoft.CodeAnalysis.CSharp.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\fr\System.Windows.Controls.Ribbon.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\mi.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-crt-string-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Drawing.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Security.Cryptography.Pkcs.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hant\System.Windows.Input.Manipulations.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\clretwrc.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\D3DCompiler_47_cor3.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ja\UIAutomationClient.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.ComponentModel.EventBasedAsync.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ru\PresentationCore.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Diagnostics.FileVersionInfo.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\PresentationFramework.Classic.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\es\Microsoft.CodeAnalysis.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\hostpolicy.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Text.Encoding.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\app.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Windows.Forms.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\it\UIAutomationClientSideProviders.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hans\System.Windows.Input.Manipulations.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pt-BR\PresentationUI.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Net.WebProxy.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Security.Cryptography.Csp.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Globalization.Extensions.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.IO.Compression.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Net.NetworkInformation.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\tr\UIAutomationProvider.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ru\Microsoft.CodeAnalysis.CSharp.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.IO.FileSystem.Watcher.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ja\PresentationFramework.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Web.HttpUtility.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ko\PresentationFramework.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hant\System.Xaml.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\clrcompression.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\cs\PresentationUI.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pt-BR\System.Windows.Controls.Ribbon.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\tr\UIAutomationClient.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-core-util-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pt-BR\System.Xaml.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Diagnostics.Tracing.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\fr\System.Windows.Input.Manipulations.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\WindowsBase.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\mscorrc.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\Newtonsoft.Json.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Net.WebClient.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\cs\System.Windows.Forms.Design.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Console.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Threading.Tasks.Extensions.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ru\PresentationUI.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.ServiceProcess.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-core-file-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Globalization.Calendars.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\mscordaccore.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\de\System.Windows.Forms.Design.Editors.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Web.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\fr\Microsoft.CodeAnalysis.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-core-string-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Net.Http.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Xml.XmlDocument.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\dbgshim.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\PresentationFramework-SystemXmlLinq.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pl\UIAutomationTypes.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\it\System.Windows.Forms.Design.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Reflection.DispatchProxy.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hans\UIAutomationClientSideProviders.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\cs\UIAutomationClientSideProviders.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\tr\System.Windows.Input.Manipulations.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Security.Cryptography.ProtectedData.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hant\System.Windows.Forms.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\Microsoft.Win32.Registry.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\it\UIAutomationTypes.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\de\Microsoft.CodeAnalysis.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-core-interlocked-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\fr\PresentationFramework.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\PenImc_cor3.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\Microsoft.CodeAnalysis.CSharp.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-crt-heap-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Threading.Timer.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.ValueTuple.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Runtime.WindowsRuntime.UI.Xaml.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\Microsoft.Win32.SystemEvents.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hant\Microsoft.CodeAnalysis.CSharp.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pl\System.Windows.Input.Manipulations.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\UIAutomationClient.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Xml.XmlSerializer.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Net.ServicePoint.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Diagnostics.TextWriterTraceListener.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\es\System.Windows.Controls.Ribbon.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.IO.IsolatedStorage.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-crt-utility-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Printing.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ko\ReachFramework.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hant\PresentationFramework.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\de\PresentationFramework.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Runtime.Loader.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Xml.XPath.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Collections.NonGeneric.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\Microsoft.CSharp.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.IO.Pipes.AccessControl.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\it\System.Windows.Forms.Design.Editors.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ko\UIAutomationClientSideProviders.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hans\PresentationCore.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\PresentationCore.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Numerics.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\fr\UIAutomationClient.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Net.NameResolution.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hans\System.Xaml.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Threading.AccessControl.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hans\System.Windows.Forms.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Text.RegularExpressions.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\tr\Microsoft.CodeAnalysis.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\tr\PresentationUI.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hant\PresentationCore.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Collections.Specialized.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Security.Principal.Windows.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Runtime.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hans\PresentationFramework.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\cs\WindowsFormsIntegration.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\es\WindowsFormsIntegration.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pt-BR\ReachFramework.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\fr\ReachFramework.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\wpfgfx_cor3.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hant\UIAutomationTypes.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Xml.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Diagnostics.Tools.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ja\System.Windows.Input.Manipulations.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\mscorlib.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hans\UIAutomationProvider.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ru\System.Windows.Controls.Ribbon.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Net.WebSockets.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ja\Microsoft.CodeAnalysis.CSharp.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\fr\System.Windows.Forms.Design.Editors.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Threading.Overlapped.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Reflection.Primitives.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ja\PresentationCore.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\it\ReachFramework.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Dynamic.Runtime.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ja\UIAutomationProvider.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\es\System.Windows.Forms.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\de\WindowsFormsIntegration.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\tr\System.Windows.Forms.Design.Editors.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Windows.Input.Manipulations.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\de\UIAutomationClientSideProviders.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Runtime.Serialization.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\tr\System.Xaml.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Net.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ja\System.Windows.Forms.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ko\UIAutomationProvider.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\fr\PresentationUI.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-crt-convert-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.IO.Compression.FileSystem.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Reflection.Metadata.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Memory.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Collections.Concurrent.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\cs\UIAutomationTypes.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Resources.ResourceManager.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-core-console-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Net.Mail.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\es\System.Windows.Forms.Design.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\PresentationFramework.Aero.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hans\UIAutomationClient.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\fr\System.Windows.Forms.Design.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\tr\System.Windows.Forms.Design.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ko\Microsoft.CodeAnalysis.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Linq.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Security.Cryptography.Primitives.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Runtime.Serialization.Json.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.ObjectModel.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\es\WindowsBase.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\it\PresentationCore.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Data.Common.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\es\UIAutomationClientSideProviders.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pl\System.Windows.Controls.Ribbon.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-crt-multibyte-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.ComponentModel.DataAnnotations.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hans\WindowsFormsIntegration.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\api-ms-win-core-localization-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\fr\UIAutomationClientSideProviders.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\pt-BR\UIAutomationProvider.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Drawing.Common.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\mscordbi.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Private.Xml.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.IO.FileSystem.DriveInfo.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Windows.Controls.Ribbon.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Runtime.Extensions.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\ja\PresentationUI.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Windows.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\zh-Hant\System.Windows.Forms.Design.Editors.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Reflection.Emit.ILGeneration.dll Jump to dropped file
Source: C:\Users\user\Desktop\PdfConverters.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.net\PdfConverters\c58\System.Runtime.CompilerServices.VisualC.dll Jump to dropped file
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\PdfConverters.exe TID: 7752 Thread sleep time: -2767011611056431s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe TID: 7744 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe TID: 7836 Thread sleep count: 69 > 30 Jump to behavior
Queries keyboard layouts
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809 Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe File Volume queried: C:\Users\user\AppData\Local\Temp\PdfConverters.WebView2\EBWebView\Default\Code Cache\js FullSizeInformation Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe File Volume queried: C:\Users\user\AppData\Local\Temp\PdfConverters.WebView2\EBWebView\Default\Code Cache\wasm FullSizeInformation Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe File Volume queried: C:\Users\user\AppData\Local\Temp\PdfConverters.WebView2\EBWebView\Default\Cache\Cache_Data FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe File opened: C:\Users\user\AppData\Local\ Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe File opened: C:\Users\user\AppData\ Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe File opened: C:\Users\user\AppData\Local\Temp\PdfConverters.WebView2\EBWebView\Default\Local Storage\leveldb\ Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe File opened: C:\Users\user\ Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe File opened: C:\Users\user\AppData\Local\Temp\PdfConverters.WebView2\EBWebView\ Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe File opened: C:\Users\user\AppData\Local\Temp\PdfConverters.WebView2\EBWebView\Default\Local Storage\ Jump to behavior
Source: msedgewebview2.exe, 00000007.00000002.2564493462.00000260E0846000.00000004.00000020.00020000.00000000.sdmp, msedgewebview2.exe, 0000000A.00000002.2540753272.000001E20943F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\Desktop\PdfConverters.exe Process information queried: ProcessInformation Jump to behavior
Enables debug privileges
Source: C:\Users\user\Desktop\PdfConverters.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\PdfConverters.exe Memory allocated: page read and write | page guard Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\user\AppData\Local\Temp\PdfConverters.WebView2\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\user\AppData\Local\Temp\PdfConverters.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=117.0.2045.47 --initial-client-data=0x15c,0x160,0x164,0x138,0x170,0x7ff899758e88,0x7ff899758e98,0x7ff899758ea8 Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Temp\PdfConverters.WebView2\EBWebView" --webview-exe-name=PdfConverters.exe --webview-exe-version=1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --edge-webview-custom-scheme --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1828 --field-trial-handle=1832,i,9339170682265001696,394570848035688689,262144 --enable-features=MojoIpcz /prefetch:2 Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Temp\PdfConverters.WebView2\EBWebView" --webview-exe-name=PdfConverters.exe --webview-exe-version=1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --edge-webview-custom-scheme --mojo-platform-channel-handle=3100 --field-trial-handle=1832,i,9339170682265001696,394570848035688689,262144 --enable-features=MojoIpcz /prefetch:3 Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Temp\PdfConverters.WebView2\EBWebView" --webview-exe-name=PdfConverters.exe --webview-exe-version=1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --edge-webview-custom-scheme --mojo-platform-channel-handle=3340 --field-trial-handle=1832,i,9339170682265001696,394570848035688689,262144 --enable-features=MojoIpcz /prefetch:8 Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Temp\PdfConverters.WebView2\EBWebView" --webview-exe-name=PdfConverters.exe --webview-exe-version=1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --edge-webview-custom-scheme --disable-nacl --first-renderer-process --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1714168248658982 --launch-time-ticks=4314058757 --mojo-platform-channel-handle=3636 --field-trial-handle=1832,i,9339170682265001696,394570848035688689,262144 --enable-features=MojoIpcz /prefetch:1 Jump to behavior
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: C:\Users\user\Desktop\PdfConverters.exe Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=pdfconverters.exe --webview-exe-version=1.0 --user-data-dir="c:\users\user\appdata\local\temp\pdfconverters.webview2\ebwebview" --noerrdialogs --embedded-browser-webview-dpi-awareness=0 --edge-webview-custom-scheme --enable-features=mojoipcz --mojo-named-platform-channel-pipe=3160.7800.5259682614117425049
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=c:\users\user\appdata\local\temp\pdfconverters.webview2\ebwebview /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=c:\users\user\appdata\local\temp\pdfconverters.webview2\ebwebview\crashpad --annotation=isofficialbuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=win64 "--annotation=prod=edge webview2" --annotation=ver=117.0.2045.47 --initial-client-data=0x15c,0x160,0x164,0x138,0x170,0x7ff899758e88,0x7ff899758e98,0x7ff899758ea8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="c:\users\user\appdata\local\temp\pdfconverters.webview2\ebwebview" --webview-exe-name=pdfconverters.exe --webview-exe-version=1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --edge-webview-custom-scheme --gpu-preferences=waaaaaaaaadgaaamaaaaaaaaaaaaaaaaaabgaaaaaaa4aaaaaaaaaaaaaaaeaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaagaaaaaaaaaayaaaaaaaaaagaaaaaaaaacaaaaaaaaaaiaaaaaaaaaa== --mojo-platform-channel-handle=1828 --field-trial-handle=1832,i,9339170682265001696,394570848035688689,262144 --enable-features=mojoipcz /prefetch:2
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --noerrdialogs --user-data-dir="c:\users\user\appdata\local\temp\pdfconverters.webview2\ebwebview" --webview-exe-name=pdfconverters.exe --webview-exe-version=1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --edge-webview-custom-scheme --mojo-platform-channel-handle=3100 --field-trial-handle=1832,i,9339170682265001696,394570848035688689,262144 --enable-features=mojoipcz /prefetch:3
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.storageservice --lang=en-gb --service-sandbox-type=service --noerrdialogs --user-data-dir="c:\users\user\appdata\local\temp\pdfconverters.webview2\ebwebview" --webview-exe-name=pdfconverters.exe --webview-exe-version=1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --edge-webview-custom-scheme --mojo-platform-channel-handle=3340 --field-trial-handle=1832,i,9339170682265001696,394570848035688689,262144 --enable-features=mojoipcz /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="c:\users\user\appdata\local\temp\pdfconverters.webview2\ebwebview" --webview-exe-name=pdfconverters.exe --webview-exe-version=1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --edge-webview-custom-scheme --disable-nacl --first-renderer-process --lang=en-gb --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_ch" --time-ticks-at-unix-epoch=-1714168248658982 --launch-time-ticks=4314058757 --mojo-platform-channel-handle=3636 --field-trial-handle=1832,i,9339170682265001696,394570848035688689,262144 --enable-features=mojoipcz /prefetch:1
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=c:\users\user\appdata\local\temp\pdfconverters.webview2\ebwebview /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=c:\users\user\appdata\local\temp\pdfconverters.webview2\ebwebview\crashpad --annotation=isofficialbuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=win64 "--annotation=prod=edge webview2" --annotation=ver=117.0.2045.47 --initial-client-data=0x15c,0x160,0x164,0x138,0x170,0x7ff899758e88,0x7ff899758e98,0x7ff899758ea8 Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="c:\users\user\appdata\local\temp\pdfconverters.webview2\ebwebview" --webview-exe-name=pdfconverters.exe --webview-exe-version=1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --edge-webview-custom-scheme --gpu-preferences=waaaaaaaaadgaaamaaaaaaaaaaaaaaaaaabgaaaaaaa4aaaaaaaaaaaaaaaeaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaagaaaaaaaaaayaaaaaaaaaagaaaaaaaaacaaaaaaaaaaiaaaaaaaaaa== --mojo-platform-channel-handle=1828 --field-trial-handle=1832,i,9339170682265001696,394570848035688689,262144 --enable-features=mojoipcz /prefetch:2 Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --noerrdialogs --user-data-dir="c:\users\user\appdata\local\temp\pdfconverters.webview2\ebwebview" --webview-exe-name=pdfconverters.exe --webview-exe-version=1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --edge-webview-custom-scheme --mojo-platform-channel-handle=3100 --field-trial-handle=1832,i,9339170682265001696,394570848035688689,262144 --enable-features=mojoipcz /prefetch:3 Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.storageservice --lang=en-gb --service-sandbox-type=service --noerrdialogs --user-data-dir="c:\users\user\appdata\local\temp\pdfconverters.webview2\ebwebview" --webview-exe-name=pdfconverters.exe --webview-exe-version=1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --edge-webview-custom-scheme --mojo-platform-channel-handle=3340 --field-trial-handle=1832,i,9339170682265001696,394570848035688689,262144 --enable-features=mojoipcz /prefetch:8 Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="c:\users\user\appdata\local\temp\pdfconverters.webview2\ebwebview" --webview-exe-name=pdfconverters.exe --webview-exe-version=1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --edge-webview-custom-scheme --disable-nacl --first-renderer-process --lang=en-gb --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_ch" --time-ticks-at-unix-epoch=-1714168248658982 --launch-time-ticks=4314058757 --mojo-platform-channel-handle=3636 --field-trial-handle=1832,i,9339170682265001696,394570848035688689,262144 --enable-features=mojoipcz /prefetch:1 Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Queries volume information: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\Trust Protection Lists\manifest.json VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Queries volume information: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\WidevineCdm\manifest.json VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Queries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe Queries volume information: C:\Users\user\AppData\Local\Temp\PdfConverters.WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports VolumeInformation Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1432408 Sample: PdfConverters.exe Startdate: 27/04/2024 Architecture: WINDOWS Score: 45 48 Antivirus detection for URL or domain 2->48 50 Multi AV Scanner detection for submitted file 2->50 7 PdfConverters.exe 555 2->7         started        10 chrome.exe 9 2->10         started        process3 dnsIp4 28 C:\...\WindowsFormsIntegration.resources.dll, PE32 7->28 dropped 30 C:\Users\user\...\WindowsBase.resources.dll, PE32 7->30 dropped 32 C:\Users\...\UIAutomationTypes.resources.dll, PE32 7->32 dropped 34 518 other files (none is malicious) 7->34 dropped 13 msedgewebview2.exe 33 173 7->13         started        44 192.168.2.5, 443, 49703, 49704 unknown unknown 10->44 46 239.255.255.250 unknown Reserved 10->46 16 chrome.exe 10->16         started        file5 process6 dnsIp7 52 Found strings related to Crypto-Mining 13->52 19 msedgewebview2.exe 18 13->19         started        22 msedgewebview2.exe 13->22         started        24 msedgewebview2.exe 13->24         started        26 2 other processes 13->26 36 www.google.com 142.250.80.100, 443, 49711, 49712 GOOGLEUS United States 16->36 signatures8 process9 dnsIp10 38 a.nel.cloudflare.com 35.190.80.1, 443, 49733, 49735 GOOGLEUS United States 19->38 40 www.pdfconvertercompare.com 104.26.1.18, 443, 49730, 49731 CLOUDFLARENETUS United States 19->40 42 2 other IPs or domains 19->42
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
142.250.80.100
 www.google.com United States
15169 GOOGLEUS false
104.26.1.18
 www.pdfconvertercompare.com United States
13335 CLOUDFLARENETUS false
162.159.61.3
 chrome.cloudflare-dns.com United States
13335 CLOUDFLARENETUS false
239.255.255.250
 unknown Reserved
unknown unknown false
35.190.80.1
 a.nel.cloudflare.com United States
15169 GOOGLEUS false
172.64.41.3
 unknown United States
13335 CLOUDFLARENETUS false

Private

IP
192.168.2.5

Contacted Domains

Name IP Active
chrome.cloudflare-dns.com 162.159.61.3 true
a.nel.cloudflare.com 35.190.80.1 true
www.google.com 142.250.80.100 true
www.pdfconvertercompare.com 104.26.1.18 true