remcos | d71b625ed03ed8629f0cffa7c61cbd882f0c2541f84c9f17320b351d44ca0381

Analysis

max time kernel
149s
max time network
147s
platform
windows10_x64
resource
win10-en-20210920
submitted
28-09-2021 02:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d71b625ed03ed8629f0cffa7c61cbd882f0c2541f84c9f17320b351d44ca0381.exe
Size

507KB
MD5

bc9d4feac55d2bc2a7721db06aa4597c
SHA1

109364c2ded28d6e5ab61c49fa16e744905fc4a6
SHA256

d71b625ed03ed8629f0cffa7c61cbd882f0c2541f84c9f17320b351d44ca0381
SHA512

a7218dd17a5720be4d7544d8eeb31fe327e4fc746d797e8c3d17f530b464ba813a51b385c3a6d94581ab1e8910eec014cf39ea51d00fc3eec37eff9dca07ba8c

Score

10^/10

remcos post-vax microsoft evasion persistence phishing rat trojan

Malware Config

Extracted

Family

remcos

Version

1.7 Pro

Botnet

Post-Vax

yjune2021.duckdns.org:3030

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
Windows NT Audio Jack Device Pictures.exe
copy_folder
Windows Start-Ups Sound Audio
delete_file
false
hide_file
true
hide_keylog_file
true
install_flag
true
install_path
%WinDir%
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
Windows Display
keylog_path
%WinDir%
mouse_option
false
mutex
Windows Audio
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screens
screenshot_path
%AppData%
screenshot_time
1
startup_value
Microsoft NT Sound Jack Players
take_screenshot_option
true
take_screenshot_time
5
take_screenshot_title
Username;password;proforma;invoice;notepad

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112
Executes dropped EXE 2 IoCs

Processes:

Windows NT Audio Jack Device Pictures.exeWindows NT Audio Jack Device Pictures.exe

pid process

1268 Windows NT Audio Jack Device Pictures.exe
3980 Windows NT Audio Jack Device Pictures.exe

pid	process
1268	Windows NT Audio Jack Device Pictures.exe
3980	Windows NT Audio Jack Device Pictures.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

d71b625ed03ed8629f0cffa7c61cbd882f0c2541f84c9f17320b351d44ca0381.exeWindows NT Audio Jack Device Pictures.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\	d71b625ed03ed8629f0cffa7c61cbd882f0c2541f84c9f17320b351d44ca0381.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft NT Sound Jack Players = "\"C:\\Windows\\Windows Start-Ups Sound Audio\\Windows NT Audio Jack Device Pictures.exe\""	d71b625ed03ed8629f0cffa7c61cbd882f0c2541f84c9f17320b351d44ca0381.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\	Windows NT Audio Jack Device Pictures.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft NT Sound Jack Players = "\"C:\\Windows\\Windows Start-Ups Sound Audio\\Windows NT Audio Jack Device Pictures.exe\""	Windows NT Audio Jack Device Pictures.exe

Detected potential entity reuse from brand microsoft.
phishing microsoft

Suspicious use of SetThreadContext 3 IoCs

Processes:

d71b625ed03ed8629f0cffa7c61cbd882f0c2541f84c9f17320b351d44ca0381.exeWindows NT Audio Jack Device Pictures.exeWindows NT Audio Jack Device Pictures.exe

description	pid	process	target process
PID 2372 set thread context of 2572	2372	d71b625ed03ed8629f0cffa7c61cbd882f0c2541f84c9f17320b351d44ca0381.exe	d71b625ed03ed8629f0cffa7c61cbd882f0c2541f84c9f17320b351d44ca0381.exe
PID 1268 set thread context of 3980	1268	Windows NT Audio Jack Device Pictures.exe	Windows NT Audio Jack Device Pictures.exe
PID 3980 set thread context of 4004	3980	Windows NT Audio Jack Device Pictures.exe	iexplore.exe

Drops file in Windows directory 7 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exed71b625ed03ed8629f0cffa7c61cbd882f0c2541f84c9f17320b351d44ca0381.exe

description	ioc	process
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\Windows Start-Ups Sound Audio\Windows NT Audio Jack Device Pictures.exe	d71b625ed03ed8629f0cffa7c61cbd882f0c2541f84c9f17320b351d44ca0381.exe
File opened for modification	C:\Windows\Windows Start-Ups Sound Audio\Windows NT Audio Jack Device Pictures.exe	d71b625ed03ed8629f0cffa7c61cbd882f0c2541f84c9f17320b351d44ca0381.exe
File opened for modification	C:\Windows\Windows Start-Ups Sound Audio	d71b625ed03ed8629f0cffa7c61cbd882f0c2541f84c9f17320b351d44ca0381.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

MicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\NextPromptBuild = "15063"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\FlipAheadCompletedVersion = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "268435456"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\FontSize = "3"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension = "5"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension = "{F5F71AA1-5931-4F77-A253-39CA89506B57}"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 47fdc11610b4d701	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\AllComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 010000001dabbfd26d51b272fb5bf4f9464bd009f5548618f2a3f663f2729e43a4d1aca47e51906f82ffea39946fe5398babdb3f6a53a679fc48848faca4b3cadfdc2b0eda4f7fe39aa26dcf8ea593a610a9f575ec7a4d54b172dfb4724778c3b894ca569747fd29015b7f69b69c361ede63d891296bbc784841eed3ebfa84d5021af88fbdd832008c48530b1ff5e01a66fb83cf91c4930a10d50006fa5f482d6d8ccfc8a4a2086b9a8a2ff23c4ec46ad88fda8eca262a0d9d4d27d308152c7d560b4f12ba45d3cc3142a350584876021041c9f520320f84e6cbabd3cebb16112bb7883d4461d78c268efc5bd583e5cdbb2f6a608886a91f686ed5a88bf339f222b0bf785d961a4dac8f67a7bf9fc7a1f27bb7a041c44e7d0a56323d1c5c34165d1604b66b844cb19d65e2d4803c5cff6d44dd10f48a62f48ba2bc5bba95b9a451094be712cbb5b401312c897cfb8d20f7a93a71627a72f694742794f140cf4849a99600330b4392cb111ac27a7abc1265cccf9b0c3219fbedeb356e59fc1392301604d88ee37438b9262b6c3c5aa8dddbcbdc01d3539a0340270eefa11a33256f423db881b0c00173b4cb35	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PageSetup	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Next Rating Prompt = f00cd1417dc6d701	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "395205405"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url1 = "https://www.facebook.com/"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\DetectPhoneNumberComplete = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\SettingsVersion = "2"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url3 = "https://signin.ebay.com/ws/ebayisapi.dll"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows\AllowInPrivate	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IntelliForms	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 0000000000000000	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\InternetRegistry	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exe

pid process

688 reg.exe
3740 reg.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

524 PING.EXE

pid	process
688	reg.exe
3740	reg.exe

pid	process
524	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

d71b625ed03ed8629f0cffa7c61cbd882f0c2541f84c9f17320b351d44ca0381.exe

pid	process
2372	d71b625ed03ed8629f0cffa7c61cbd882f0c2541f84c9f17320b351d44ca0381.exe
2372	d71b625ed03ed8629f0cffa7c61cbd882f0c2541f84c9f17320b351d44ca0381.exe

Suspicious behavior: MapViewOfSection 4 IoCs

Processes:

MicrosoftEdgeCP.exe

pid process

2800 MicrosoftEdgeCP.exe
2800 MicrosoftEdgeCP.exe
2800 MicrosoftEdgeCP.exe
2800 MicrosoftEdgeCP.exe

pid	process
2800	MicrosoftEdgeCP.exe
2800	MicrosoftEdgeCP.exe
2800	MicrosoftEdgeCP.exe
2800	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

Processes:

d71b625ed03ed8629f0cffa7c61cbd882f0c2541f84c9f17320b351d44ca0381.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	pid	process
Token: SeDebugPrivilege	2372	d71b625ed03ed8629f0cffa7c61cbd882f0c2541f84c9f17320b351d44ca0381.exe
Token: SeDebugPrivilege	3968	MicrosoftEdge.exe
Token: SeDebugPrivilege	3968	MicrosoftEdge.exe
Token: SeDebugPrivilege	3968	MicrosoftEdge.exe
Token: SeDebugPrivilege	3968	MicrosoftEdge.exe
Token: SeDebugPrivilege	864	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	864	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	864	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	864	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4636	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4636	MicrosoftEdgeCP.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exe

pid process

3968 MicrosoftEdge.exe
2800 MicrosoftEdgeCP.exe
2800 MicrosoftEdgeCP.exe

pid	process
3968	MicrosoftEdge.exe
2800	MicrosoftEdgeCP.exe
2800	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

d71b625ed03ed8629f0cffa7c61cbd882f0c2541f84c9f17320b351d44ca0381.exed71b625ed03ed8629f0cffa7c61cbd882f0c2541f84c9f17320b351d44ca0381.execmd.execmd.exeWindows NT Audio Jack Device Pictures.exeWindows NT Audio Jack Device Pictures.execmd.exeMicrosoftEdgeCP.exe

description	pid	process	target process
PID 2372 wrote to memory of 2916	2372	d71b625ed03ed8629f0cffa7c61cbd882f0c2541f84c9f17320b351d44ca0381.exe	d71b625ed03ed8629f0cffa7c61cbd882f0c2541f84c9f17320b351d44ca0381.exe
PID 2372 wrote to memory of 2916	2372	d71b625ed03ed8629f0cffa7c61cbd882f0c2541f84c9f17320b351d44ca0381.exe	d71b625ed03ed8629f0cffa7c61cbd882f0c2541f84c9f17320b351d44ca0381.exe
PID 2372 wrote to memory of 2916	2372	d71b625ed03ed8629f0cffa7c61cbd882f0c2541f84c9f17320b351d44ca0381.exe	d71b625ed03ed8629f0cffa7c61cbd882f0c2541f84c9f17320b351d44ca0381.exe
PID 2372 wrote to memory of 2572	2372	d71b625ed03ed8629f0cffa7c61cbd882f0c2541f84c9f17320b351d44ca0381.exe	d71b625ed03ed8629f0cffa7c61cbd882f0c2541f84c9f17320b351d44ca0381.exe
PID 2372 wrote to memory of 2572	2372	d71b625ed03ed8629f0cffa7c61cbd882f0c2541f84c9f17320b351d44ca0381.exe	d71b625ed03ed8629f0cffa7c61cbd882f0c2541f84c9f17320b351d44ca0381.exe
PID 2372 wrote to memory of 2572	2372	d71b625ed03ed8629f0cffa7c61cbd882f0c2541f84c9f17320b351d44ca0381.exe	d71b625ed03ed8629f0cffa7c61cbd882f0c2541f84c9f17320b351d44ca0381.exe
PID 2372 wrote to memory of 2572	2372	d71b625ed03ed8629f0cffa7c61cbd882f0c2541f84c9f17320b351d44ca0381.exe	d71b625ed03ed8629f0cffa7c61cbd882f0c2541f84c9f17320b351d44ca0381.exe
PID 2372 wrote to memory of 2572	2372	d71b625ed03ed8629f0cffa7c61cbd882f0c2541f84c9f17320b351d44ca0381.exe	d71b625ed03ed8629f0cffa7c61cbd882f0c2541f84c9f17320b351d44ca0381.exe
PID 2372 wrote to memory of 2572	2372	d71b625ed03ed8629f0cffa7c61cbd882f0c2541f84c9f17320b351d44ca0381.exe	d71b625ed03ed8629f0cffa7c61cbd882f0c2541f84c9f17320b351d44ca0381.exe
PID 2372 wrote to memory of 2572	2372	d71b625ed03ed8629f0cffa7c61cbd882f0c2541f84c9f17320b351d44ca0381.exe	d71b625ed03ed8629f0cffa7c61cbd882f0c2541f84c9f17320b351d44ca0381.exe
PID 2372 wrote to memory of 2572	2372	d71b625ed03ed8629f0cffa7c61cbd882f0c2541f84c9f17320b351d44ca0381.exe	d71b625ed03ed8629f0cffa7c61cbd882f0c2541f84c9f17320b351d44ca0381.exe
PID 2372 wrote to memory of 2572	2372	d71b625ed03ed8629f0cffa7c61cbd882f0c2541f84c9f17320b351d44ca0381.exe	d71b625ed03ed8629f0cffa7c61cbd882f0c2541f84c9f17320b351d44ca0381.exe
PID 2572 wrote to memory of 3776	2572	d71b625ed03ed8629f0cffa7c61cbd882f0c2541f84c9f17320b351d44ca0381.exe	cmd.exe
PID 2572 wrote to memory of 3776	2572	d71b625ed03ed8629f0cffa7c61cbd882f0c2541f84c9f17320b351d44ca0381.exe	cmd.exe
PID 2572 wrote to memory of 3776	2572	d71b625ed03ed8629f0cffa7c61cbd882f0c2541f84c9f17320b351d44ca0381.exe	cmd.exe
PID 3776 wrote to memory of 688	3776	cmd.exe	reg.exe
PID 3776 wrote to memory of 688	3776	cmd.exe	reg.exe
PID 3776 wrote to memory of 688	3776	cmd.exe	reg.exe
PID 2572 wrote to memory of 408	2572	d71b625ed03ed8629f0cffa7c61cbd882f0c2541f84c9f17320b351d44ca0381.exe	cmd.exe
PID 2572 wrote to memory of 408	2572	d71b625ed03ed8629f0cffa7c61cbd882f0c2541f84c9f17320b351d44ca0381.exe	cmd.exe
PID 2572 wrote to memory of 408	2572	d71b625ed03ed8629f0cffa7c61cbd882f0c2541f84c9f17320b351d44ca0381.exe	cmd.exe
PID 408 wrote to memory of 524	408	cmd.exe	PING.EXE
PID 408 wrote to memory of 524	408	cmd.exe	PING.EXE
PID 408 wrote to memory of 524	408	cmd.exe	PING.EXE
PID 408 wrote to memory of 1268	408	cmd.exe	Windows NT Audio Jack Device Pictures.exe
PID 408 wrote to memory of 1268	408	cmd.exe	Windows NT Audio Jack Device Pictures.exe
PID 408 wrote to memory of 1268	408	cmd.exe	Windows NT Audio Jack Device Pictures.exe
PID 1268 wrote to memory of 3980	1268	Windows NT Audio Jack Device Pictures.exe	Windows NT Audio Jack Device Pictures.exe
PID 1268 wrote to memory of 3980	1268	Windows NT Audio Jack Device Pictures.exe	Windows NT Audio Jack Device Pictures.exe
PID 1268 wrote to memory of 3980	1268	Windows NT Audio Jack Device Pictures.exe	Windows NT Audio Jack Device Pictures.exe
PID 1268 wrote to memory of 3980	1268	Windows NT Audio Jack Device Pictures.exe	Windows NT Audio Jack Device Pictures.exe
PID 1268 wrote to memory of 3980	1268	Windows NT Audio Jack Device Pictures.exe	Windows NT Audio Jack Device Pictures.exe
PID 1268 wrote to memory of 3980	1268	Windows NT Audio Jack Device Pictures.exe	Windows NT Audio Jack Device Pictures.exe
PID 1268 wrote to memory of 3980	1268	Windows NT Audio Jack Device Pictures.exe	Windows NT Audio Jack Device Pictures.exe
PID 1268 wrote to memory of 3980	1268	Windows NT Audio Jack Device Pictures.exe	Windows NT Audio Jack Device Pictures.exe
PID 1268 wrote to memory of 3980	1268	Windows NT Audio Jack Device Pictures.exe	Windows NT Audio Jack Device Pictures.exe
PID 3980 wrote to memory of 2332	3980	Windows NT Audio Jack Device Pictures.exe	cmd.exe
PID 3980 wrote to memory of 2332	3980	Windows NT Audio Jack Device Pictures.exe	cmd.exe
PID 3980 wrote to memory of 2332	3980	Windows NT Audio Jack Device Pictures.exe	cmd.exe
PID 2332 wrote to memory of 3740	2332	cmd.exe	reg.exe
PID 2332 wrote to memory of 3740	2332	cmd.exe	reg.exe
PID 2332 wrote to memory of 3740	2332	cmd.exe	reg.exe
PID 3980 wrote to memory of 4004	3980	Windows NT Audio Jack Device Pictures.exe	iexplore.exe
PID 3980 wrote to memory of 4004	3980	Windows NT Audio Jack Device Pictures.exe	iexplore.exe
PID 3980 wrote to memory of 4004	3980	Windows NT Audio Jack Device Pictures.exe	iexplore.exe
PID 3980 wrote to memory of 4004	3980	Windows NT Audio Jack Device Pictures.exe	iexplore.exe
PID 3980 wrote to memory of 4004	3980	Windows NT Audio Jack Device Pictures.exe	iexplore.exe
PID 3980 wrote to memory of 4004	3980	Windows NT Audio Jack Device Pictures.exe	iexplore.exe
PID 3980 wrote to memory of 4004	3980	Windows NT Audio Jack Device Pictures.exe	iexplore.exe
PID 3980 wrote to memory of 4004	3980	Windows NT Audio Jack Device Pictures.exe	iexplore.exe
PID 2800 wrote to memory of 864	2800	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2800 wrote to memory of 864	2800	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2800 wrote to memory of 864	2800	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2800 wrote to memory of 864	2800	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2800 wrote to memory of 864	2800	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2800 wrote to memory of 864	2800	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2800 wrote to memory of 864	2800	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2800 wrote to memory of 864	2800	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2800 wrote to memory of 864	2800	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2800 wrote to memory of 864	2800	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2800 wrote to memory of 864	2800	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2800 wrote to memory of 864	2800	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2800 wrote to memory of 864	2800	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2800 wrote to memory of 4292	2800	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe

C:\Users\Admin\AppData\Local\Temp\d71b625ed03ed8629f0cffa7c61cbd882f0c2541f84c9f17320b351d44ca0381.exe
"C:\Users\Admin\AppData\Local\Temp\d71b625ed03ed8629f0cffa7c61cbd882f0c2541f84c9f17320b351d44ca0381.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2372

C:\Users\Admin\AppData\Local\Temp\d71b625ed03ed8629f0cffa7c61cbd882f0c2541f84c9f17320b351d44ca0381.exe
"C:\Users\Admin\AppData\Local\Temp\d71b625ed03ed8629f0cffa7c61cbd882f0c2541f84c9f17320b351d44ca0381.exe"
2⤵
PID:2916

C:\Users\Admin\AppData\Local\Temp\d71b625ed03ed8629f0cffa7c61cbd882f0c2541f84c9f17320b351d44ca0381.exe
"C:\Users\Admin\AppData\Local\Temp\d71b625ed03ed8629f0cffa7c61cbd882f0c2541f84c9f17320b351d44ca0381.exe"
2⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2572

C:\Windows\SysWOW64\cmd.exe
/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
3⤵
- Suspicious use of WriteProcessMemory
PID:3776

C:\Windows\SysWOW64\reg.exe
C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
4⤵
- Modifies registry key
PID:688

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:408

C:\Windows\SysWOW64\PING.EXE
PING 127.0.0.1 -n 2
4⤵
- Runs ping.exe
PID:524

C:\Windows\Windows Start-Ups Sound Audio\Windows NT Audio Jack Device Pictures.exe
"C:\Windows\Windows Start-Ups Sound Audio\Windows NT Audio Jack Device Pictures.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1268

C:\Windows\Windows Start-Ups Sound Audio\Windows NT Audio Jack Device Pictures.exe
"C:\Windows\Windows Start-Ups Sound Audio\Windows NT Audio Jack Device Pictures.exe"
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3980

C:\Windows\SysWOW64\cmd.exe
/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
6⤵
- Suspicious use of WriteProcessMemory
PID:2332

C:\Windows\SysWOW64\reg.exe
C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
7⤵
- Modifies registry key
PID:3740

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
6⤵
PID:4004

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3968

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:2396

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2800

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:864

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4292

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4636

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4756

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4844

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\24YENFJ1\4474c202.site-ltr[1].css
MD5
56c823adf59262ca5bcb5636591ce96b

SHA1
26637817c1d4fa1d029a80feb5dca076c1909544

SHA256
0de758b8035b8983d0fe461bd1b2a03a9489a7eefd987217f79d045f00f16c6f

SHA512
19de6309876ee31c1c7676fbe2b83f817922d969d950b5edb005c1c149083603dc7ec30f44a4d1132ffdf634e1fa30685ece53965964d21264572a694a912ba5

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\24YENFJ1\MathJax[1].js
MD5
7a3737a82ea79217ebe20f896bceb623

SHA1
96b575bbae7dac6a442095996509b498590fbbf7

SHA256
002a60f162fd4d3081f435860d408ffce6f6ef87398f75bd791cadc8dae0771d

SHA512
e0d1f62bae160008e486a6f4ef8b57aa74c1945980c00deb37b083958f4291f0a47b994e5fdb348c2d4618346b93636ce4c323c6f510ab2fbd7a6547359d28d5

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\24YENFJ1\docons.fa060c7a[1].woff2
MD5
5d062f872c1600833f39feb797a9e7db

SHA1
3fef40e5e5a99058821699be07e35a4328e255c4

SHA256
78dbf0f234ec92b20a4354ff1391709f63ba3dc973f14b0e7e3fd52f12a10a4c

SHA512
7fac8479c7b7a1fb954c1ac311b2f4a7019f8bfb5c601f099a562de7af777b5e14ec3816b9425a0bf07250a12adf811a0bb700e0d1f37d9f9f3c3d69576aac45

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\24YENFJ1\jsll-4[1].js
MD5
211e123b593464f3fef68f0b6e00127a

SHA1
0fae8254d06b487f09a003cb8f610f96a95465d1

SHA256
589303ca15fba4fe95432dbb456ff614d0f2ad12d99f8671f0443a7f0cf48dff

SHA512
dad54d7941a7588675ea9dd11275a60fb6290e1582d1c7a4acb50642af3c2a4aa35e32edd8fa9dd01ce7fd777247d2706d5672a201633bf918b525936e93b14b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\24YENFJ1\wcp-consent[1].js
MD5
38b769522dd0e4c2998c9034a54e174e

SHA1
d95ef070878d50342b045dcf9abd3ff4cca0aaf3

SHA256
208edbed32b2adac9446df83caa4a093a261492ba6b8b3bcfe6a75efb8b70294

SHA512
f0a10a4c1ca4bac8a2dbd41f80bbe1f83d767a4d289b149e1a7b6e7f4dba41236c5ff244350b04e2ef485fdf6eb774b9565a858331389ca3cb474172465eb3ef

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ECEVD2BG\12971179[1].jpg
MD5
0e4994ae0e03d9611e7655286675f156

SHA1
e650534844a7197b328371318f288ae081448a97

SHA256
07b979b12f1cb506df7675efe227a2e78accfa1f5954af2b7bb66295e5cf881c

SHA512
07aaae5347fa8e82f86d0ba7c28127fac952d84bad3dce119654b5ba1cd2550c8d064770473f34f89fc383847b2f1594b3600d9fd01e6275d67868c41638e34a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ECEVD2BG\24882762[1].jpg
MD5
ca711d527e0e1be012a3105699592812

SHA1
f02534ce002f6d734a897491a1ebcc825da565c7

SHA256
e68e548a3cc404e84af3fd7529c21d64a238ba5d0857feb8fa1652b439b36e6f

SHA512
a56a1266a76ee7c95424f5beaed9d65ea569e7d187beae3c4bc1fb3a018ac728f419a2b08b62c51a70e18ee82d54e1d7714092e609135bb455060ab7d01830b5

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ECEVD2BG\2672110[1].png
MD5
7dc91895d24c825c361387611f6593e9

SHA1
fc0d26031ba690ac7748c759c35005fe627beb8f

SHA256
f37ad9b56d806d06267f9a290196dfe4200edb7729b41d789b8f1ec8adc5cdbf

SHA512
ba27fdbf02294cc78ede7972f20da383c20027ab172a4ea6ad5006ff58e404032d92f875e642dfe73985428c28bbbe1befc546c2666a672afacf23195425d7c2

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ECEVD2BG\31348972[1].jpg
MD5
c09597bbae67e58e38228f9e8fa06175

SHA1
85aec568955ad5d9165364d37a9a141dd899eca9

SHA256
f62142fd084d46df32d9d8a340855fcb17b14376c36549b825670451ea7cae73

SHA512
b7592dcf34487e3ddbffd32e8d03cb5665330f8f687e10f39f16c67673238e340cf4633b8e921932c65e3c891286349378bb70ad9a8026046653c4cf8fa2efff

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ECEVD2BG\36da565a.index-docs[1].js
MD5
e2930a0bd7661dd3217f2cfa9a5bbada

SHA1
ce4255979ef15dff82136d92647a1e6611fd152c

SHA256
3715cabddb58d38685f7116b16853447e10d7d9454c8d41509209578b5308ffc

SHA512
dfc8c23d4ab6122cf3056602a911531371bcad71c20063b2247803bfa520f1edbe8947bf222b495df014dca7bb79294ec81e4741d906cea6cbcac441e953866a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ECEVD2BG\install-3-5[1].png
MD5
f6ec97c43480d41695065ad55a97b382

SHA1
d9c3d0895a5ed1a3951b8774b519b8217f0a54c5

SHA256
07a599fab1e66babc430e5fed3029f25ff3f4ea2dd0ec8968ffba71ef1872f68

SHA512
22462763178409d60609761a2af734f97b35b9a818ec1fd9046afab489aad83ce34896ee8586efe402ea7739ecf088bc2db5c1c8e4fb39e6a0fc5b3adc6b4a9b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ECEVD2BG\ms.jsll-3.min[1].js
MD5
db1c580cd28422b73814f0620aad00d9

SHA1
4dadd769be89f5b7c1843bd79434914132ec1c1c

SHA256
59e18de81c8c868b6d6276807f51a2b27e6a29ebdf44f55b520c11d5aac867d0

SHA512
2a8d4752a317990bc8bb5a98ac11d6b270c4d52fd3f3476870cb6f02fdf849999ab6f7d92645f217b1f83161fc21b475396083c04a5e42af476f337b0b3b7c83

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\EQY2GZ07\SegoeUI-Roman-VF_web[1].woff2
MD5
bca97218dca3cb15ce0284cbcb452890

SHA1
635298cbbd72b74b1762acc7dad6c79de4b3670d

SHA256
63c12051016796d92bcf4bc20b4881057475e6dfa4937c29c9e16054814ab47d

SHA512
6e850842d1e353a5457262c5c78d20704e8bd24b532368ba5e5dfc7a4b63059d536296b597fd3ccbd541aa8f89083a79d50aaa1b5e65b4d23fc37bfd806f0545

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\EQY2GZ07\TeX-AMS_CHTML[1].js
MD5
a7d2b67197a986636d79842a081ea85e

SHA1
b5e05ef7d8028a2741ec475f21560cf4e8cb2136

SHA256
9e0394a3a7bf16a1effb14fcc5557be82d9b2d662ba83bd84e303b4bdf791ef9

SHA512
ad234df68e34eb185222c24c30b384201f1e1793ad6c3dca2f54d510c7baa67eabdc39225f10e6b783757c0db859ce2ea32d6e78317c30a02d1765aee9f07109

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\EQY2GZ07\app-could-not-be-started[1].png
MD5
522037f008e03c9448ae0aaaf09e93cb

SHA1
8a32997eab79246beed5a37db0c92fbfb006bef2

SHA256
983c35607c4fb0b529ca732be42115d3fcaac947cee9c9632f7cacdbdecaf5a7

SHA512
643ec613b2e7bdbb2f61e1799c189b0e3392ea5ae10845eb0b1f1542a03569e886f4b54d5b38af10e78db49c71357108c94589474b181f6a4573b86cf2d6f0d8

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\EQY2GZ07\application-not-started[1].htm
MD5
dfe1edd6cbfd37a7191eccaad97c6475

SHA1
c35fbbc60bd06bc1704566957694f1be02d91f5b

SHA256
edb0002f524d7eb91d3202641a544e3c82479fedecc55165ee8d0b534abb2e09

SHA512
873bfa387101d81d6ab4b32f5715a9135a6b6a4abdde5b500409d36a6359be9d790ad2ddb80e209a3c86ffdc11e7067f2fd17cce52893b447b1cf9ce02a94af9

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\EQY2GZ07\repair-tool-recommended-changes[1].png
MD5
3062488f9d119c0d79448be06ed140d8

SHA1
8a148951c894fc9e968d3e46589a2e978267650e

SHA256
c47a383de6dd60149b37dd24825d42d83cb48be0ed094e3fc3b228d0a7bb9332

SHA512
00bba6bcbfbf44b977129594a47f732809dce7d4e2d22d050338e4eea91fcc02a9b333c45eeb4c9024df076cbda0b46b621bf48309c0d037d19bbeae0367f5ed

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ZK8LJW3B\5cce29c0.deprecation[1].js
MD5
55bb21475c9d3a6d3c00f2c26a075e7d

SHA1
59696ef8addd5cfb642ad99521a8aed9420e0859

SHA256
3ceddaf5a1ed02614ec6b4edd5881a3ffb7ec08116154dff8eb9897230bf5e59

SHA512
35261ddaf86da82d27a29f39a7c6074a5f0e66f5b0a8098c7502289fb70b186371a7fe71410baab6cc6b726e9338afecee9f8bb075047a055723fb5e2f09b9c7

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ZK8LJW3B\latest[1].woff2
MD5
2835ee281b077ca8ac7285702007c894

SHA1
2e3d4d912aaf1c3f1f30d95c2c4fcea1b7bbc29a

SHA256
e172a02b68f977a57a1690507df809db1e43130f0161961709a36dbd70b4d25f

SHA512
80881c074df064795f9cc5aa187bea92f0e258bf9f6b970e61e9d50ee812913bf454cecbe7fd9e151bdaef700ce68253697f545ac56d4e7ef7ade7814a1dbc5a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ZK8LJW3B\repair-tool-changes-complete[1].png
MD5
512625cf8f40021445d74253dc7c28c0

SHA1
f6b27ce0f7d4e48e34fddca8a96337f07cffe730

SHA256
1d4dcee8511d5371fec911660d6049782e12901c662b409a5c675772e9b87369

SHA512
ae02319d03884d758a86c286b6f593bdffd067885d56d82eeb8215fdcb41637c7bb9109039e7fbc93ad246d030c368fb285b3161976ed485abc5a8df6df9a38c

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ZK8LJW3B\repair-tool-no-resolution[1].png
MD5
240c4cc15d9fd65405bb642ab81be615

SHA1
5a66783fe5dd932082f40811ae0769526874bfd3

SHA256
030272ce6ba1beca700ec83fded9dbdc89296fbde0633a7f5943ef5831876c07

SHA512
267fe31bc25944dd7b6071c2c2c271ccc188ae1f6a0d7e587dcf9198b81598da6b058d1b413f228df0cb37c8304329e808089388359651e81b5f3dec566d0ee0

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\91WKLQGC.cookie
MD5
d7f4ece57a91e7148bfb4f27800921c3

SHA1
ba10ffec211fe821e244929ba8771e27d140c6fe

SHA256
01566b4b49a20bf7f6a087ba8f24510a2c236d483c4f79fb3c9f8aabd74c3089

SHA512
b0b82aab88be4ab415d1ad53fc225634ea3bd5da5fa46d7cddcb24fdbd81aea2095c2c5c32f65d402b7d9551e0860f45ee6ad909052a10df132bc017206e7d08

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\L1H99HQB.cookie
MD5
566f2b42d708b6476b470abf86f513ea

SHA1
f1f3653243a1382d0d27301e61eacd48abc3f5c5

SHA256
9003ea6ee62c2b5b95602e3b398a1211c585be1b90b1be20d22e51a4cfafbdf4

SHA512
c6e39c16bee63cf6405fa5a852ebac6ce7e8cdec99c2b1b3322eb7f6dd62f377d2d36a35b7070b29ebfdc2ec2c63a54b8123f202b658ba4c2aafa67b633c66f6

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\UUTF6JXX.cookie
MD5
3f088a78184713a07b969be706c6941f

SHA1
c63a032f35910190a97d6e57a46b5bbb2f032255

SHA256
5e3c9064c735bd8acddaefe1edaa487dc594ed97e802d845b9eeea27d979513a

SHA512
43b2988826a71a51f9ee47e3003075703b29fe7ac1e36531bb1bafe38bb0bde79219ff8fd2c88125fb9f7b9efa4bf860bbc7ee828ff684b20b9dc1846e99c58f

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\12B578593FDE07EC53D020B1D5DEBF3B_5D74C2DB556F94499BCD6D74A36958A3
MD5
c7f94106bfe0327cb82d796eda36e322

SHA1
fe3a2874004cb2e55b92704648cc0a1007d9f4b5

SHA256
f846b775d28c45d307c24a7cb738edb43d03f1b19f672d9e5e41448fc711d01a

SHA512
4270362bfc7c96330ca8b01ca838bdf76b3d564afc11d7e18bde2215e62bedf8077e4bddecfc8d97ec321b500696d2b3b7b84f0e17e24845adfc8a5656ba5689

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\2A7611428D62805A3E4E5BC4103D82E4_D0FA13DADFB59BDF00C474952E166CC1
MD5
da811827e1d313dd128ade470c8db6eb

SHA1
fda6e6ea690f18de669054d5d13783ae0ee6e40d

SHA256
37da7b11403eecb0cd4d4a25a32a9e1c5511bc9c49381af1f923bdb1abe90e19

SHA512
43ed06767f11f6e6242d2dfc30eb71197786dd567b9bc87d2219f61915c3dd171a11eaa5bc18ed4f186d95ad7ee6a51dde3bfeeb813d7bb2321c190046406de8

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63
MD5
2460f6c235d72dcc7e3dd55587b03ed7

SHA1
618a0b487253927a1f7a940f4ffe8c5fd8577d3e

SHA256
3ed0eebda555915876e538f5c649a6c0471fff0c3550485d61e0b4536e6a676b

SHA512
675d438d3cbec374914af4a4bf2c9d1f6730897451f325427928a666c2f43978e898374a15d88736b730d199db91c3b204b005b21ac90177d135b4b8fc02c45a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB
MD5
0dc5bce660f7a342c7867dfcca362bbc

SHA1
e44a6a3dc0acf2de3b274413275144b5829fa2f4

SHA256
68514875eaf5e4f16499d0380dec6a062775ec8372ea4e0a01a3e0dc347c6831

SHA512
7e0d21d2f15d66b2cbc5a926321b5de9f1fb72f8de43eecb07bbfb2ad87171b8d1e448e9a27c7896ccef0029af10e6ef052ef75638abda395884bee405d8e50c

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\12B578593FDE07EC53D020B1D5DEBF3B_5D74C2DB556F94499BCD6D74A36958A3
MD5
9d4cbc12456ab503550739e1831a4d05

SHA1
ff84e1f1df56f93cbb0e2e9334ee9a2a90b7b0fb

SHA256
d93962fde4eb71464e57929fd49f516b1bb69fff0768f44ad3052dbf73a33738

SHA512
1209887d9497bd7f0b55265cfbbd06d26b0098cc7403ba29050862045997914a2802cacf6249a00997a429afb7db95b87ce971e6df86389986defb153a04b40a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\2A7611428D62805A3E4E5BC4103D82E4_D0FA13DADFB59BDF00C474952E166CC1
MD5
1b2e7a80c64b8a1736e6282fc85096f1

SHA1
ea6cc774542382f6a8a94ba49ab40661cc44509e

SHA256
44a87ad3a476d721081ed2f331ae1a44c7f71c75e7c196477efbda57bab282e7

SHA512
79994f2d6634d24bcefb2b653a151a053ff5fafc9004569afcbfb41de8d71dd203460b0727fea9198f6b3ba901cec5f88647f3f3f9fdc5754fb070e21255aca2

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63
MD5
032feae5bf3ceb9d03a77565d0a8930f

SHA1
078c7b5bd3a67c7e736d680c5e3ed9d88891ee76

SHA256
4d6e8a2ebfd0eab6d4e64d73413cbeecac1b80d2241f9159f0431066a3396cb0

SHA512
c474a94068911d4539429a52df07d9a35ded57271da704103f874fd475342d706fb921f8a7667e8718f0054aa1e638755fe41120cd5f43049c15592acfd9a0f8

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB
MD5
a36838d1e044491ade891c482b85730c

SHA1
4e8b152cc5ace9cd610d6544c5ec830f9981151c

SHA256
ff387106b187dbe62fccf756267c99c4f3483d8f15d1a519a73f4469e2f4191b

SHA512
f739bbee74d86e4a9d61626838ffb45120b4331dfa2a0ff43214f93eb1c91ef4b9793d5f9d82880fc059987fddb29c2a14b871960422c65913a76352629d76d9

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\Windows\3720402701\2274612954.pri
MD5
0db264b38ac3c5f6c140ba120a7fe72f

SHA1
51aa2330c597e84ed3b0d64bf6b73bf6b15f9d74

SHA256
2f6955b0f5277a7904c59e461bfa6b06c54fece0d7c11f27408fa7a281a4556d

SHA512
3534c243516cef5cee0540d5efd5cde1f378e127e6013b5e309a2e0be8393417bfe458706564b4b955f92132a51e2772c67f9fd90441476cc3512a5d9f910d84

Download Submit
C:\Users\Admin\AppData\Local\Temp\install.bat
MD5
6d98fe14efb18380b8d903d8bc427a5d

SHA1
77985bd92226ff2fb0048f461f35c21633223170

SHA256
e9b60dc2a7ea9b1fbf26ed20c9239fc1d1691048705260a5a0b58b732c6f0f7a

SHA512
902c7e245bf4504ffe5997349b224068935277e41044ae7e3e8e243331fb420b7e485c790f0c7bc0fba49c0605a6627efb8965c9bd1d0060ada4e21874a6851f

Download Submit
C:\Windows\Windows Start-Ups Sound Audio\Windows NT Audio Jack Device Pictures.exe
MD5
bc9d4feac55d2bc2a7721db06aa4597c

SHA1
109364c2ded28d6e5ab61c49fa16e744905fc4a6

SHA256
d71b625ed03ed8629f0cffa7c61cbd882f0c2541f84c9f17320b351d44ca0381

SHA512
a7218dd17a5720be4d7544d8eeb31fe327e4fc746d797e8c3d17f530b464ba813a51b385c3a6d94581ab1e8910eec014cf39ea51d00fc3eec37eff9dca07ba8c

Download Submit
C:\Windows\Windows Start-Ups Sound Audio\Windows NT Audio Jack Device Pictures.exe
MD5
bc9d4feac55d2bc2a7721db06aa4597c

SHA1
109364c2ded28d6e5ab61c49fa16e744905fc4a6

SHA256
d71b625ed03ed8629f0cffa7c61cbd882f0c2541f84c9f17320b351d44ca0381

SHA512
a7218dd17a5720be4d7544d8eeb31fe327e4fc746d797e8c3d17f530b464ba813a51b385c3a6d94581ab1e8910eec014cf39ea51d00fc3eec37eff9dca07ba8c

Download Submit
C:\Windows\Windows Start-Ups Sound Audio\Windows NT Audio Jack Device Pictures.exe
MD5
bc9d4feac55d2bc2a7721db06aa4597c

SHA1
109364c2ded28d6e5ab61c49fa16e744905fc4a6

SHA256
d71b625ed03ed8629f0cffa7c61cbd882f0c2541f84c9f17320b351d44ca0381

SHA512
a7218dd17a5720be4d7544d8eeb31fe327e4fc746d797e8c3d17f530b464ba813a51b385c3a6d94581ab1e8910eec014cf39ea51d00fc3eec37eff9dca07ba8c

Download Submit
memory/408-129-0x0000000000000000-mapping.dmp

Download
memory/524-132-0x0000000000000000-mapping.dmp

Download
memory/688-128-0x0000000000000000-mapping.dmp

Download
memory/1268-142-0x00000000049C0000-0x0000000004EBE000-memory.dmp

Filesize
5.0MB

Download
memory/1268-133-0x0000000000000000-mapping.dmp

Download
memory/2332-149-0x0000000000000000-mapping.dmp

Download
memory/2372-122-0x0000000004C60000-0x0000000004C6E000-memory.dmp

Filesize
56KB

Download
memory/2372-121-0x0000000004DD0000-0x0000000004DD1000-memory.dmp

Filesize
4KB

Download
memory/2372-117-0x0000000005180000-0x0000000005181000-memory.dmp

Filesize
4KB

Download
memory/2372-118-0x0000000004C80000-0x0000000004C81000-memory.dmp

Filesize
4KB

Download
memory/2372-119-0x0000000004C80000-0x000000000517E000-memory.dmp

Filesize
5.0MB

Download
memory/2372-120-0x0000000004D20000-0x0000000004D21000-memory.dmp

Filesize
4KB

Download
memory/2372-124-0x0000000005160000-0x000000000517A000-memory.dmp

Filesize
104KB

Download
memory/2372-123-0x0000000005890000-0x00000000058D6000-memory.dmp

Filesize
280KB

Download
memory/2372-115-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/2572-125-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2572-130-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2572-126-0x000000000040FD88-mapping.dmp

Download
memory/3740-150-0x0000000000000000-mapping.dmp

Download
memory/3776-127-0x0000000000000000-mapping.dmp

Download
memory/3980-155-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3980-147-0x000000000040FD88-mapping.dmp

Download
memory/4004-152-0x000000000047FA72-mapping.dmp

Download
memory/4004-151-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download