46dc49be65d7165e2a6009854a4f27f0088230199e61e0555cb1bd266535874a

Analysis

max time kernel
157s
max time network
184s
platform
windows10_x64
resource
win10v200722
submitted
11-08-2020 12:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

foo/84bf6e1a8fcd94cf6cba6ac7e2a95b64.exe

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 4 IoCs

Processes:

setup_antivirus_license.exesetup.exesetup.tmpUpgrade.exe

pid process

3920 setup_antivirus_license.exe
2976 setup.exe
3164 setup.tmp
2972 Upgrade.exe

pid	process
3920	setup_antivirus_license.exe
2976	setup.exe
3164	setup.tmp
2972	Upgrade.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

84bf6e1a8fcd94cf6cba6ac7e2a95b64.exeUpgrade.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Control Panel\International\Geo\Nation	84bf6e1a8fcd94cf6cba6ac7e2a95b64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Control Panel\International\Geo\Nation	Upgrade.exe

Loads dropped DLL 2 IoCs

Processes:

setup.tmp

pid process

3164 setup.tmp
3164 setup.tmp
Drops file in Windows directory 1 IoCs

Processes:

MicrosoftEdge.exe

description ioc process

File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
3164	setup.tmp
3164	setup.tmp

description	ioc	process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

MicrosoftEdgeCP.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\000A	MicrosoftEdgeCP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\000A	MicrosoftEdgeCP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000	MicrosoftEdgeCP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000	MicrosoftEdgeCP.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

MicrosoftEdgeCP.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	MicrosoftEdgeCP.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	MicrosoftEdgeCP.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	MicrosoftEdgeCP.exe

Modifies Control Panel 1 IoCs
evasion

Processes:

MicrosoftEdge.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Control Panel\Colors MicrosoftEdge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Control Panel\Colors	MicrosoftEdge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

browser_broker.exeMicrosoftEdgeCP.exeMicrosoftEdge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\SettingsVersion = "2"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 243a72c3ec6fd601	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites\Order = 0c0000000a000000000000000c0000000100000000000000	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\AllComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\lendabit.com\ = "87"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "190"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "431"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\youtube.com\ = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\youtube.com\NumberOfSubdomain = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.youtube.com\ = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$MediaWiki	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 0000000000000000	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "1048"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "354"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\MigrationTime = f84f865c2260d601	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DOMStorage	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\lendabit.com\ = "32"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\lendabit.com\Total = "431"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\lendabit.com\Total = "213"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\lendabit.com\ = "1006"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "268435456"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionI	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\FirstRecoveryTime = f84f865c2260d601	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\lendabit.com\Total = "190"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows\AllowInPrivate	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "465"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\AllComplete = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\DatabaseComplete = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\ManagerHistoryComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-087602 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\lendabit.com\Total = "1006"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\www.youtube.com\ = "0"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$Telligent	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CTLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData\Md5FileCheck = 9fa75725855604a758366c6a1d9f0311	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url2 = "https://login.aliexpress.com/"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

setup.tmp

pid process

3164 setup.tmp
3164 setup.tmp
Suspicious behavior: MapViewOfSection 4 IoCs

Processes:

MicrosoftEdgeCP.exe

pid process

2584 MicrosoftEdgeCP.exe
2584 MicrosoftEdgeCP.exe
2584 MicrosoftEdgeCP.exe
2584 MicrosoftEdgeCP.exe

pid	process
3164	setup.tmp
3164	setup.tmp

pid	process
2584	MicrosoftEdgeCP.exe
2584	MicrosoftEdgeCP.exe
2584	MicrosoftEdgeCP.exe
2584	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 31 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	pid	process
Token: SeDebugPrivilege	2344	MicrosoftEdge.exe
Token: SeDebugPrivilege	2344	MicrosoftEdge.exe
Token: SeDebugPrivilege	2344	MicrosoftEdge.exe
Token: SeDebugPrivilege	2344	MicrosoftEdge.exe
Token: SeDebugPrivilege	2384	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1368	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2384	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1368	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2384	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4720	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4720	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	2384	MicrosoftEdgeCP.exe
Token: SeCreatePagefilePrivilege	2384	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	2384	MicrosoftEdgeCP.exe
Token: SeCreatePagefilePrivilege	2384	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	2384	MicrosoftEdgeCP.exe
Token: SeCreatePagefilePrivilege	2384	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	2384	MicrosoftEdgeCP.exe
Token: SeCreatePagefilePrivilege	2384	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	2384	MicrosoftEdgeCP.exe
Token: SeCreatePagefilePrivilege	2384	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	2384	MicrosoftEdgeCP.exe
Token: SeCreatePagefilePrivilege	2384	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	2384	MicrosoftEdgeCP.exe
Token: SeCreatePagefilePrivilege	2384	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	2384	MicrosoftEdgeCP.exe
Token: SeCreatePagefilePrivilege	2384	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	2384	MicrosoftEdgeCP.exe
Token: SeCreatePagefilePrivilege	2384	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	2384	MicrosoftEdgeCP.exe
Token: SeCreatePagefilePrivilege	2384	MicrosoftEdgeCP.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

setup.tmp

pid process

3164 setup.tmp
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exe

pid process

2344 MicrosoftEdge.exe
2584 MicrosoftEdgeCP.exe
2584 MicrosoftEdgeCP.exe

pid	process
3164	setup.tmp

pid	process
2344	MicrosoftEdge.exe
2584	MicrosoftEdgeCP.exe
2584	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 37 IoCs

Processes:

84bf6e1a8fcd94cf6cba6ac7e2a95b64.exesetup_antivirus_license.exesetup.exesetup.tmpMicrosoftEdgeCP.exe

description	pid	process	target process
PID 828 wrote to memory of 3920	828	84bf6e1a8fcd94cf6cba6ac7e2a95b64.exe	setup_antivirus_license.exe
PID 828 wrote to memory of 3920	828	84bf6e1a8fcd94cf6cba6ac7e2a95b64.exe	setup_antivirus_license.exe
PID 828 wrote to memory of 3920	828	84bf6e1a8fcd94cf6cba6ac7e2a95b64.exe	setup_antivirus_license.exe
PID 3920 wrote to memory of 2976	3920	setup_antivirus_license.exe	setup.exe
PID 3920 wrote to memory of 2976	3920	setup_antivirus_license.exe	setup.exe
PID 3920 wrote to memory of 2976	3920	setup_antivirus_license.exe	setup.exe
PID 2976 wrote to memory of 3164	2976	setup.exe	setup.tmp
PID 2976 wrote to memory of 3164	2976	setup.exe	setup.tmp
PID 2976 wrote to memory of 3164	2976	setup.exe	setup.tmp
PID 3164 wrote to memory of 2972	3164	setup.tmp	Upgrade.exe
PID 3164 wrote to memory of 2972	3164	setup.tmp	Upgrade.exe
PID 3164 wrote to memory of 2972	3164	setup.tmp	Upgrade.exe
PID 2584 wrote to memory of 2384	2584	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2584 wrote to memory of 2384	2584	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2584 wrote to memory of 2384	2584	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2584 wrote to memory of 1368	2584	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2584 wrote to memory of 1368	2584	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2584 wrote to memory of 1368	2584	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2584 wrote to memory of 1368	2584	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2584 wrote to memory of 1368	2584	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2584 wrote to memory of 1368	2584	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2584 wrote to memory of 1368	2584	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2584 wrote to memory of 2384	2584	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2584 wrote to memory of 2384	2584	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2584 wrote to memory of 2384	2584	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2584 wrote to memory of 2384	2584	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2584 wrote to memory of 2384	2584	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2584 wrote to memory of 2384	2584	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2584 wrote to memory of 2384	2584	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2584 wrote to memory of 2384	2584	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2584 wrote to memory of 2384	2584	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2584 wrote to memory of 2384	2584	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2584 wrote to memory of 2384	2584	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2584 wrote to memory of 2384	2584	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2584 wrote to memory of 2384	2584	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2584 wrote to memory of 2384	2584	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2584 wrote to memory of 2384	2584	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe

C:\Users\Admin\AppData\Local\Temp\foo\84bf6e1a8fcd94cf6cba6ac7e2a95b64.exe
"C:\Users\Admin\AppData\Local\Temp\foo\84bf6e1a8fcd94cf6cba6ac7e2a95b64.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:828

C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup_antivirus_license.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup_antivirus_license.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\setup.exe
"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\setup.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976

C:\Users\Admin\AppData\Local\Temp\is-D1QTM.tmp\setup.tmp
"C:\Users\Admin\AppData\Local\Temp\is-D1QTM.tmp\setup.tmp" /SL5="$301C4,138489,56832,C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\setup.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3164

C:\Users\Admin\AppData\Local\Temp\is-777C9.tmp\Upgrade.exe
"C:\Users\Admin\AppData\Local\Temp\is-777C9.tmp\Upgrade.exe"
5⤵
- Executes dropped EXE
- Checks computer location settings
PID:2972

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2344

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:2856

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2584

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1368

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2384

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4720

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5016

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5104

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\HQZ4P02B\Windows%20and%20Office%20Premium%20Activator%202020%201.4_3107017959[1].exe
MD5
f68ec9fc9d7b2fa8a4a0ad505e787b35

SHA1
d494676634a7947c4d246f7fd9d863bfe1af33b8

SHA256
4ae96cdb65414fab164fff0119a80138610d03741a3db7c73085b94413904129

SHA512
b825ef58df4deb325cdac9236e0565551762eda53e94d4da7d5ba8763c52c58af056392dcf93cb78901a076fc5eb93d36e2f2f0b952f5c61332c6597abc0b5cc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\1FHQYJ7X.cookie
MD5
847605ab6dc5bfa901e20e69c736d4d8

SHA1
1fd6ee040a8fbac6677987fab6619eaa807dba98

SHA256
6717990e5cc1e3c7c50c0e65c1353055140cacb5815a58a0aae1babd0125b694

SHA512
dd9c570629e054dcb5bf4e6e8800d50f2d29224f19e4a76d91462308722ff308c2f448f235c51c112d2830674dd90e83d9a4eeb082e3928289ae0b289b16204f

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\4O5XWUG1.cookie
MD5
2430a6a7078b6659b30c0b8782a81097

SHA1
1b22048b57104e4596e30716e13d4f19bf1ae3a6

SHA256
9411e2970619334238236786237d6e776cf51f8139c6e169d73c9701e73fd685

SHA512
eb80b76aa48e4de994d78c3b27b21a4e3e5e8b59794db687c34422e91e77ccdd9919478e2c5fb1cfcdd85b5c0df374b19a1d38b960160580db62399b6c51cb64

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\G78AO2Z3.cookie
MD5
0518867ce525fa88243923d57b5f3485

SHA1
a54badd613d5c39757219b2a0d0b28d031d70b85

SHA256
141bd8bf4ba463210f44224cc29e75f6108e53ccd6240e05f0d1fb1dded50821

SHA512
f6aa4a59c25216a12d694a0b1368aed02d2802770c5f6de175d03c0bf2fe1e3d0923807692c36a02c1b225de040e6ce79c92806d8feaf5bc4f3a6f81915f1cdd

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\HXSAOBDY.cookie
MD5
19d3497f7845c220a901abbddf801d37

SHA1
be6b0e545854e554919c1ed3d7f9265e4fcf9e21

SHA256
414e8b7b63cd8886738666848a7477a63de0bd85197f1fc4842ff237d52979dc

SHA512
f476e93420c990112a17c73286258f7700089793b52887abb21b1cb28b4643ac0fb6b591c1802828207db57902323aaadcae4c971300d20385d7989b4dcb0369

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\IDS5NSBT.cookie
MD5
a87bcef0c06d3cc1201c35b79484952e

SHA1
1b4dfafab3195c98ae1da36412cdb5343e9ae02b

SHA256
37cc918d526cfbb0e0cb66d10becb5257c0794335e68ea4e968a59bb38ed5dd7

SHA512
922d462cbc7b4e27e6d23b683204f84fa35c1f8f9bbbd4e74b69e09ebee0bbeb74c20bbd43de88d3ade9fab3c4e5705f01553ea22c7e8ffaabf747c6396a0709

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\QNNVW3WH.cookie
MD5
f61402f548a40e51fa821eb3c7916fdb

SHA1
6906577fa3a85d49d9b7f3fdb46ccd6ff1e23629

SHA256
4a7415506887532d9caa50f41b9aa3ea6c190a84763b0634bf3c04f2a69d3748

SHA512
b8e6234e7f8d19cac63dff6a15fe18751777b053e42529f6b68d127a82ddbdf7f743e8b889aa03d15412bad468d61afab803829cc8591087e6a8bf81daa3a8cc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\TLBVV5B0.cookie
MD5
d8949f304f80752ae870ae7a9830af1e

SHA1
e6619f32f15defc84e33e9261f63b40d87eea1a7

SHA256
fa0f123631cd970ffb817e09a66adf03b1acb85cc79efa07241f6370cb47cc45

SHA512
04457875dcdcfc6c010afa67e6166248a0e4d724d0aee262067d084093d473846f528ec3df5c5df8bc0d0293ffdf83960e954bd7c7918f8709ef1706dbc99b99

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
MD5
ff24736b88ecc23913bebf59bbea0bcc

SHA1
1be3371fb8089aab645f7b350776c303832b3bb7

SHA256
e0057ec01486fa81cf224e7849418496d45363f848ef7ea4b89bdd924284afea

SHA512
f6a1e384e1c9fac62162b80e203ae42d8a22f9dc68d5ff907d14d9389724cd300fe659ff0684d4b58dbe200202031d23c01089bc02ddcee7e6691cf154c38c9a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220
MD5
ae10a4b07e60fb31f794da18b751a3ac

SHA1
019a028e5e931ac1cc045be0a87227f852ff413d

SHA256
a524f6b47c3aabbb21ad262c09cc6a7ed5025fa52c7b1e107bad4a7c2216a254

SHA512
eb37c674ae32a9e67c0eaf53550deafd8c7b52d848b0e0efc01ffdd41f6bd307c42473312654b511ec7ad9b2661f64bed5c373c4fb68fbd3872542bc52f7e065

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
MD5
07460bae625908225cc9c6767415c842

SHA1
e8470df526dc8eef1a64a63b36b6b07f5fe4a79c

SHA256
000553c2c9e74bebb3f84f678bb0fe53bc97cbb3d514034541ba11b94f28fe2e

SHA512
205a0de442cb434773028a276a4fa1a5985a863f614dfa0bbece711f06356c9cebe10136780f4ee6c14c1c2f7205f5a0abb519580171528d39077b6d8bf948b8

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
MD5
37336b17ee9efcc917387e7b22d2fc2f

SHA1
218b0cb297b3f2b9e438f797a9374bddd8426d07

SHA256
18a325878ae0ca794ea1012d92d955dd42641b5ce3424045d7e59d993f061f4b

SHA512
03ee8ce6b21607e2adad448e9218a444be68b779adc680d9ba5080d9ac022848d298527d7d3fb62d0ac389939bd8b718e48e8b16856bcff4c902f0416beda090

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220
MD5
bf26f332669026b45871528083fd9add

SHA1
56a47c6b2d3b6792d279041460dd95a5f06ba6cb

SHA256
c08afbc0b00d13e6a5aaf7450b18f7a24ff2d4bb33796a9e56815d134308873e

SHA512
2b7d956107f7a57646bf6b29669c7ea12f2024c0abe49b2420fdde9024636339cd7656d3a0a1c9ae636c1e09548b20e0e47e6c410caee68126f5b66c52f65e47

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
MD5
ea129e48a5a38801b716b75128100153

SHA1
90458f8ff8be92bce59b06804209dd2f5ee26b8d

SHA256
092ac8c78a1b69715b93e661913d94ffa194402ecbdbd0b2d01a8d2cc5dd4cac

SHA512
77d43d9a40a3c188ec05b50c687fd3dfddc7e4bcc5e16385721440aea69f7112f0f7ddf33a2b66c25858a0f6979c6b396870c08d5db2e5d7f44795424c0cc53f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\setup.exe
MD5
99c06a99d02b512f4bde1abae2465af6

SHA1
4bbb1fc293437929c9e1e4f66f6df6eaa8041ee8

SHA256
9ccf75cc457ccf8eb7284b49d6563603fd46852927e879c1600baa85896749e7

SHA512
8f6a558bb62d03c7958097c9ccda6122cd2d73f9d31f6e00e4e1c7027159ec7ae67afdeb45449681b0491a1a75471efec819373a496f20a4fce180db99ae14e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\setup.exe
MD5
99c06a99d02b512f4bde1abae2465af6

SHA1
4bbb1fc293437929c9e1e4f66f6df6eaa8041ee8

SHA256
9ccf75cc457ccf8eb7284b49d6563603fd46852927e879c1600baa85896749e7

SHA512
8f6a558bb62d03c7958097c9ccda6122cd2d73f9d31f6e00e4e1c7027159ec7ae67afdeb45449681b0491a1a75471efec819373a496f20a4fce180db99ae14e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup_antivirus_license.exe
MD5
1a2f91043b9cad2ca07f409948708309

SHA1
355d6d91f27a464503535749aca3266dfa8c5ae3

SHA256
812416093b576b92dc23e83314d077870476d6f84454ab4c6a2479553023cc9c

SHA512
66e2330a0fa2c8600e747faf5c9687af3154ecfd8150f66e7f15b2f96b1910c7b1e0a8a4b18972d16fa6f63b03c058272d8d0e08002d9981cb8375d15c27009a

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup_antivirus_license.exe
MD5
1a2f91043b9cad2ca07f409948708309

SHA1
355d6d91f27a464503535749aca3266dfa8c5ae3

SHA256
812416093b576b92dc23e83314d077870476d6f84454ab4c6a2479553023cc9c

SHA512
66e2330a0fa2c8600e747faf5c9687af3154ecfd8150f66e7f15b2f96b1910c7b1e0a8a4b18972d16fa6f63b03c058272d8d0e08002d9981cb8375d15c27009a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-777C9.tmp\Upgrade.exe
MD5
fa210703ef9c064fdb880a6203f67f4e

SHA1
4f856e90f71b05120bd925bbef52df41b85f5e98

SHA256
c1406704ede8ff64cbc51cba887dc47463b6ccc96d58b1a5b7bf305a68c461ca

SHA512
30f70040ec6460905a9557b58dbcddcfaf1c644058e38e5144d7ef62481d765f43e558b4cf88eb5f8b8209b3eeeebc893f70b4312afa29bf052c3e0ad6e4d119

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-777C9.tmp\Upgrade.exe
MD5
fa210703ef9c064fdb880a6203f67f4e

SHA1
4f856e90f71b05120bd925bbef52df41b85f5e98

SHA256
c1406704ede8ff64cbc51cba887dc47463b6ccc96d58b1a5b7bf305a68c461ca

SHA512
30f70040ec6460905a9557b58dbcddcfaf1c644058e38e5144d7ef62481d765f43e558b4cf88eb5f8b8209b3eeeebc893f70b4312afa29bf052c3e0ad6e4d119

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-D1QTM.tmp\setup.tmp
MD5
ffcf263a020aa7794015af0edee5df0b

SHA1
bce1eb5f0efb2c83f416b1782ea07c776666fdab

SHA256
1d07cfb7104b85fc0dffd761f6848ad176117e146bbb4079fe993efa06b94c64

SHA512
49f2b062adfb99c0c7f1012c56f0b52a8850d9f030cc32073b90025b372e4eb373f06a351e9b33264967427b8174c060c8a6110979f0eaf0872f7da6d5e4308a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-D1QTM.tmp\setup.tmp
MD5
ffcf263a020aa7794015af0edee5df0b

SHA1
bce1eb5f0efb2c83f416b1782ea07c776666fdab

SHA256
1d07cfb7104b85fc0dffd761f6848ad176117e146bbb4079fe993efa06b94c64

SHA512
49f2b062adfb99c0c7f1012c56f0b52a8850d9f030cc32073b90025b372e4eb373f06a351e9b33264967427b8174c060c8a6110979f0eaf0872f7da6d5e4308a

Download Submit
\Users\Admin\AppData\Local\Temp\is-777C9.tmp\itdownload.dll
MD5
d82a429efd885ca0f324dd92afb6b7b8

SHA1
86bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea

SHA256
b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3

SHA512
5bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df

Download Submit
\Users\Admin\AppData\Local\Temp\is-777C9.tmp\itdownload.dll
MD5
d82a429efd885ca0f324dd92afb6b7b8

SHA1
86bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea

SHA256
b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3

SHA512
5bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df

Download Submit
memory/2972-17-0x00000000745C0000-0x0000000074653000-memory.dmp

Filesize
588KB

Download
memory/2972-14-0x0000000000000000-mapping.dmp

Download
memory/2976-7-0x00000000745C0000-0x0000000074653000-memory.dmp

Filesize
588KB

Download
memory/2976-4-0x0000000000000000-mapping.dmp

Download
memory/3164-11-0x00000000745C0000-0x0000000074653000-memory.dmp

Filesize
588KB

Download
memory/3164-8-0x0000000000000000-mapping.dmp

Download
memory/3920-3-0x00000000745C0000-0x0000000074653000-memory.dmp

Filesize
588KB

Download
memory/3920-0-0x0000000000000000-mapping.dmp

Download