remcos | 1730338ca0fbfe0985bed5638fc8599a6dd38761ab8b89e3d8a076947a320028

Resubmissions

09-10-2021 11:54

211009-n3dp3afccm 10

07-10-2021 14:54

211007-r9wq1acef7 10

Analysis

max time kernel
152s
max time network
153s
platform
windows10_x64
resource
win10v20210408
submitted
07-10-2021 14:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ShippingDocs.exe
Size

55KB
MD5

a3e458f7e2e1f940b0c62042afe607d3
SHA1

6fb0a031365530ebb273f47f034181a530e31b70
SHA256

1730338ca0fbfe0985bed5638fc8599a6dd38761ab8b89e3d8a076947a320028
SHA512

9d27b5a6e1086b315bb71cccca1f64e718d1815adbccde1a3483e1404ec3d5d8a6eddc90de373e362543a8db69bf5118e36fef6c8b4cc82d40a4f771b44766e8

Score

10^/10

remcos remusd31k microsoft persistence phishing rat

Malware Config

Extracted

Family

remcos

Version

3.3.0 Pro

Botnet

remUSD31k

yedaibi.com:8760

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
zoom-FKG2PK
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
notepad;solitaire;

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

ShippingDocs.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Local\\zoom.exe\","	ShippingDocs.exe

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Detected potential entity reuse from brand microsoft.
phishing microsoft

Suspicious use of SetThreadContext 5 IoCs

Processes:

ShippingDocs.exeShippingDocs.exe

description	pid	process	target process
PID 532 set thread context of 1148	532	ShippingDocs.exe	ShippingDocs.exe
PID 1148 set thread context of 3624	1148	ShippingDocs.exe	svchost.exe
PID 1148 set thread context of 2304	1148	ShippingDocs.exe	svchost.exe
PID 1148 set thread context of 4452	1148	ShippingDocs.exe	svchost.exe
PID 1148 set thread context of 4880	1148	ShippingDocs.exe	svchost.exe

Drops file in Windows directory 1 IoCs

Processes:

MicrosoftEdge.exe

description ioc process

File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

MicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar\WebBrowser	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e188831be45da54795de47a63c2975e3000000000200000000001066000000010000200000003774fb8119ccaa622dbdf250ed4c5f682494b779c09bb63dae87ca665870a97d000000000e8000000002000020000000a223744db7180836f0cb16640de2b1b22563e56e05949473e7b93449b8a0d9e140020000efd30d84b812539ff788223fe8fd06765c8d7c05e49918a3cd764a9c8bbb010a3a05e5e8570bf6b5ed9f77137a2ab531569c8ca0e5ed9af8005be2f80095021b2c24afee8b485facf73fc8cda13665585ce45d57a9af834b4c4a944b6c09ce8ab52a13c39caab6aef90030aefabcf2f746b5d3b7a29c14283fa603571a91962dc77e2b8c1f2ea914e14042861193e74da4ada7f22f3da73b36e19f4cd46a07600434361564bf8650fed232fefee42efccefc0ea5c60ea536180273846e03c0a5b2fd7642e7c3cc69b05494feef8102bb5a3eccafa7ff47d9359295faa1bd550a73fc96e612866d2925c8b1d621400e1aa2a030d5c44ea57abf18b3ecefb19808eb12ca13eaa181b64ed083592e51b393efc8b629f734dba24391e06b4baa4ba015dc54f8eae1a82292f08bf8a550c169d28095e485c5745638bdc1a042a9955f4ce07114d1d80a6b8f66fc28ea5228a164321cf68ba23714c20a733e8929f3aed788f1a80791f764c709be377efdead4295c98359b49b3358fb22049393ce5b3029b6c2bb32a0294435ab4e3586c8c88f86ddb9f98418c2bef0bb31920f29a600173a74d4dd7b0285dfae74b2ff20cd49e69ed28383fc79af6ca91f4ffd9c02d0363e74b8406239805b0bb00000ec3cfa1f7f26992a1b0be9baf28f8b013446df83447c49e63cd1d05ca88ee515fd8c8df41e14dfc147bdcc2931e94c1e9e53d444870279bafa3084681aa7c2c009824158f373dcb83e62646853bec49be0350ede4964f6637dc271fcee81f0338407afa4715413883e7c1025df5edc6d62f5e40000000a860ec78ae46224995dfb883b4d1c88d6dea838688acd7b34d34d32e17732e48a50ea9838362ba0accb1aea0a9e22628467065ea8f33ee276af277a9647b7329	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\FontSize = "3"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 0000000000000000	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\SmartScreenCompletedVersi = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Zoom	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url3 = "https://signin.ebay.com/ws/ebayisapi.dll"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\TypedUrlsComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "268435456"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\DetectPhoneNumberComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension = "5"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 5244bfefe5bbd701	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming\ChangeUnitGenerationNeeded = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 01000000a7d12f70cf853cd8ddc4651cb8f26b039fa6837af0d6ad7cec610b3cb26cce77b44792b460c38cd4f22c89bbc55cd18e70895221beced117e2996c7469654681c07eb30eb8bd6db7685d5d460e6b5e51c67c71cb33944c068c6a25b0ce9245585d170d092395d9ebd0f63a4c103f821c932192780a4609dca574c570d414b0c347b0f073ee69f8a3f998f7a3d8f755d13b1776d11205cdc7e45766b67b0cf61b6eeacf2b385b49761ae4c72b96b53802d0fd64375ff1e05b46b3dca320986c62a0658cf6d3898ccffe78ac330e9896e7ca7597e6642a4c287028dab99dd92c938ec1876dc415fd3373f612ff75c088a6721eed2b2ad010204556b597f4efca56e79e58f70e1e784c99fc39f38c4c60e3ab9730a208036cd502ddbb564bfb71fe219de3d2ffc3e8cd662c66aea35e6ea5ee82a28a49e3d47e745d686ee71bb8cd085ce0302326ed1f1a24bbf5e915018d487e752a1690b7d18f75ab29bf705c9c797c5a60e965a5e59c850f362b91ff5ab62a613f2f2a98aa97c7e4b1661b53bcf49d37075ba2fb4c5af0429065f228bc792842825cd19185a48342fe3003584c803ee84b859f	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\DatastoreSchemaVersion = "8"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration	MicrosoftEdge.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

powershell.exepowershell.exeShippingDocs.exe

pid	process
688	powershell.exe
688	powershell.exe
688	powershell.exe
1156	powershell.exe
1156	powershell.exe
1156	powershell.exe
532	ShippingDocs.exe
532	ShippingDocs.exe
532	ShippingDocs.exe

Suspicious behavior: MapViewOfSection 14 IoCs

Processes:

MicrosoftEdgeCP.exe

pid	process
3864	MicrosoftEdgeCP.exe
3864	MicrosoftEdgeCP.exe
3864	MicrosoftEdgeCP.exe
3864	MicrosoftEdgeCP.exe
3864	MicrosoftEdgeCP.exe
3864	MicrosoftEdgeCP.exe
3864	MicrosoftEdgeCP.exe
3864	MicrosoftEdgeCP.exe
3864	MicrosoftEdgeCP.exe
3864	MicrosoftEdgeCP.exe
3864	MicrosoftEdgeCP.exe
3864	MicrosoftEdgeCP.exe
3864	MicrosoftEdgeCP.exe
3864	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exe

description	pid	process
Token: SeDebugPrivilege	688	powershell.exe
Token: SeIncreaseQuotaPrivilege	688	powershell.exe
Token: SeSecurityPrivilege	688	powershell.exe
Token: SeTakeOwnershipPrivilege	688	powershell.exe
Token: SeLoadDriverPrivilege	688	powershell.exe
Token: SeSystemProfilePrivilege	688	powershell.exe
Token: SeSystemtimePrivilege	688	powershell.exe
Token: SeProfSingleProcessPrivilege	688	powershell.exe
Token: SeIncBasePriorityPrivilege	688	powershell.exe
Token: SeCreatePagefilePrivilege	688	powershell.exe
Token: SeBackupPrivilege	688	powershell.exe
Token: SeRestorePrivilege	688	powershell.exe
Token: SeShutdownPrivilege	688	powershell.exe
Token: SeDebugPrivilege	688	powershell.exe
Token: SeSystemEnvironmentPrivilege	688	powershell.exe
Token: SeRemoteShutdownPrivilege	688	powershell.exe
Token: SeUndockPrivilege	688	powershell.exe
Token: SeManageVolumePrivilege	688	powershell.exe
Token: 33	688	powershell.exe
Token: 34	688	powershell.exe
Token: 35	688	powershell.exe
Token: 36	688	powershell.exe
Token: SeIncreaseQuotaPrivilege	688	powershell.exe
Token: SeSecurityPrivilege	688	powershell.exe
Token: SeTakeOwnershipPrivilege	688	powershell.exe
Token: SeLoadDriverPrivilege	688	powershell.exe
Token: SeSystemProfilePrivilege	688	powershell.exe
Token: SeSystemtimePrivilege	688	powershell.exe
Token: SeProfSingleProcessPrivilege	688	powershell.exe
Token: SeIncBasePriorityPrivilege	688	powershell.exe
Token: SeCreatePagefilePrivilege	688	powershell.exe
Token: SeBackupPrivilege	688	powershell.exe
Token: SeRestorePrivilege	688	powershell.exe
Token: SeShutdownPrivilege	688	powershell.exe
Token: SeDebugPrivilege	688	powershell.exe
Token: SeSystemEnvironmentPrivilege	688	powershell.exe
Token: SeRemoteShutdownPrivilege	688	powershell.exe
Token: SeUndockPrivilege	688	powershell.exe
Token: SeManageVolumePrivilege	688	powershell.exe
Token: 33	688	powershell.exe
Token: 34	688	powershell.exe
Token: 35	688	powershell.exe
Token: 36	688	powershell.exe
Token: SeIncreaseQuotaPrivilege	688	powershell.exe
Token: SeSecurityPrivilege	688	powershell.exe
Token: SeTakeOwnershipPrivilege	688	powershell.exe
Token: SeLoadDriverPrivilege	688	powershell.exe
Token: SeSystemProfilePrivilege	688	powershell.exe
Token: SeSystemtimePrivilege	688	powershell.exe
Token: SeProfSingleProcessPrivilege	688	powershell.exe
Token: SeIncBasePriorityPrivilege	688	powershell.exe
Token: SeCreatePagefilePrivilege	688	powershell.exe
Token: SeBackupPrivilege	688	powershell.exe
Token: SeRestorePrivilege	688	powershell.exe
Token: SeShutdownPrivilege	688	powershell.exe
Token: SeDebugPrivilege	688	powershell.exe
Token: SeSystemEnvironmentPrivilege	688	powershell.exe
Token: SeRemoteShutdownPrivilege	688	powershell.exe
Token: SeUndockPrivilege	688	powershell.exe
Token: SeManageVolumePrivilege	688	powershell.exe
Token: 33	688	powershell.exe
Token: 34	688	powershell.exe
Token: 35	688	powershell.exe
Token: 36	688	powershell.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exe

pid process

1936 MicrosoftEdge.exe
3864 MicrosoftEdgeCP.exe
3864 MicrosoftEdgeCP.exe

pid	process
1936	MicrosoftEdge.exe
3864	MicrosoftEdgeCP.exe
3864	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

ShippingDocs.exeShippingDocs.exeMicrosoftEdgeCP.exe

description	pid	process	target process
PID 532 wrote to memory of 688	532	ShippingDocs.exe	powershell.exe
PID 532 wrote to memory of 688	532	ShippingDocs.exe	powershell.exe
PID 532 wrote to memory of 688	532	ShippingDocs.exe	powershell.exe
PID 532 wrote to memory of 4004	532	ShippingDocs.exe	powershell.exe
PID 532 wrote to memory of 4004	532	ShippingDocs.exe	powershell.exe
PID 532 wrote to memory of 4004	532	ShippingDocs.exe	powershell.exe
PID 532 wrote to memory of 1156	532	ShippingDocs.exe	powershell.exe
PID 532 wrote to memory of 1156	532	ShippingDocs.exe	powershell.exe
PID 532 wrote to memory of 1156	532	ShippingDocs.exe	powershell.exe
PID 532 wrote to memory of 1148	532	ShippingDocs.exe	ShippingDocs.exe
PID 532 wrote to memory of 1148	532	ShippingDocs.exe	ShippingDocs.exe
PID 532 wrote to memory of 1148	532	ShippingDocs.exe	ShippingDocs.exe
PID 532 wrote to memory of 1148	532	ShippingDocs.exe	ShippingDocs.exe
PID 532 wrote to memory of 1148	532	ShippingDocs.exe	ShippingDocs.exe
PID 532 wrote to memory of 1148	532	ShippingDocs.exe	ShippingDocs.exe
PID 532 wrote to memory of 1148	532	ShippingDocs.exe	ShippingDocs.exe
PID 532 wrote to memory of 1148	532	ShippingDocs.exe	ShippingDocs.exe
PID 532 wrote to memory of 1148	532	ShippingDocs.exe	ShippingDocs.exe
PID 532 wrote to memory of 1148	532	ShippingDocs.exe	ShippingDocs.exe
PID 532 wrote to memory of 1148	532	ShippingDocs.exe	ShippingDocs.exe
PID 532 wrote to memory of 1148	532	ShippingDocs.exe	ShippingDocs.exe
PID 1148 wrote to memory of 3624	1148	ShippingDocs.exe	svchost.exe
PID 1148 wrote to memory of 3624	1148	ShippingDocs.exe	svchost.exe
PID 1148 wrote to memory of 3624	1148	ShippingDocs.exe	svchost.exe
PID 1148 wrote to memory of 3624	1148	ShippingDocs.exe	svchost.exe
PID 1148 wrote to memory of 3624	1148	ShippingDocs.exe	svchost.exe
PID 1148 wrote to memory of 3624	1148	ShippingDocs.exe	svchost.exe
PID 1148 wrote to memory of 3624	1148	ShippingDocs.exe	svchost.exe
PID 1148 wrote to memory of 3624	1148	ShippingDocs.exe	svchost.exe
PID 3864 wrote to memory of 916	3864	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3864 wrote to memory of 916	3864	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3864 wrote to memory of 916	3864	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1148 wrote to memory of 2304	1148	ShippingDocs.exe	svchost.exe
PID 1148 wrote to memory of 2304	1148	ShippingDocs.exe	svchost.exe
PID 1148 wrote to memory of 2304	1148	ShippingDocs.exe	svchost.exe
PID 1148 wrote to memory of 2304	1148	ShippingDocs.exe	svchost.exe
PID 1148 wrote to memory of 2304	1148	ShippingDocs.exe	svchost.exe
PID 1148 wrote to memory of 2304	1148	ShippingDocs.exe	svchost.exe
PID 1148 wrote to memory of 2304	1148	ShippingDocs.exe	svchost.exe
PID 1148 wrote to memory of 2304	1148	ShippingDocs.exe	svchost.exe
PID 3864 wrote to memory of 1704	3864	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3864 wrote to memory of 1704	3864	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3864 wrote to memory of 1704	3864	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3864 wrote to memory of 1704	3864	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3864 wrote to memory of 916	3864	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3864 wrote to memory of 916	3864	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3864 wrote to memory of 916	3864	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3864 wrote to memory of 916	3864	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3864 wrote to memory of 916	3864	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3864 wrote to memory of 916	3864	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3864 wrote to memory of 916	3864	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3864 wrote to memory of 916	3864	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3864 wrote to memory of 916	3864	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3864 wrote to memory of 916	3864	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3864 wrote to memory of 1704	3864	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3864 wrote to memory of 1704	3864	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3864 wrote to memory of 1704	3864	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3864 wrote to memory of 1704	3864	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3864 wrote to memory of 4136	3864	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3864 wrote to memory of 4136	3864	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3864 wrote to memory of 4136	3864	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3864 wrote to memory of 4136	3864	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3864 wrote to memory of 4136	3864	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3864 wrote to memory of 4136	3864	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe

C:\Users\Admin\AppData\Local\Temp\ShippingDocs.exe
"C:\Users\Admin\AppData\Local\Temp\ShippingDocs.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:532
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection -TraceRoute twitter.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:688
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection -TraceRoute twitter.com
  2⤵
  PID:4004
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection -TraceRoute twitter.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1156
- C:\Users\Admin\AppData\Local\Temp\ShippingDocs.exe
  C:\Users\Admin\AppData\Local\Temp\ShippingDocs.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1148
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:3624
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:2304
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:4452
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:4872
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:4880

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1936

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:1268

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3864

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:916

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:1704

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4136

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4324

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4484

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4680

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4912

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:752

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4652

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5
1712dab0a1bf4e9e3ff666b9c431550d

SHA1
34d1dec8fa95f62c72cb3f92a22c13ad9eece10f

SHA256
7184a35390c8d6549ef4ddf2909c8fc3446572229bb1788fe178332d80ebfa97

SHA512
6ae29c37c11c851ed337afee3c3ad654593063e76df88a6974933e449ac8d86bfa005b9bf2e0ee29aad4647b8f8f32ac753587077fd745424be7f9765688e7b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

MD5
1c33ff599b382b705675229c91fc2f99

SHA1
c20086746c14c5d57be9a3df47bd75fa77abe7e0

SHA256
d46b6790776328125154bb8231deafcc7786911bea48fbcd2742c05fa1c4da0a

SHA512
5b975f6b0d5407d8d43975c0fd0c26ecb155f6ee9b7416e39478f84e97deea590d1eb0cf2a972adcf96eba6745fdef472f6fcf51d85cd53c2da9b4c550ee413c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5
aca84d8b76c67675bd8cb6fb73646eac

SHA1
f97f08b8c765cb40dec9d3bb6435e14a8d8f10d1

SHA256
44f808a9ba1b5cb19e355948da26cf933c960702044ae43eeca0ee4885fac19e

SHA512
12e3788347385f3ba529f407dda07dd466ee5ea6e3217e45163725214b91cbfb5d2ce655e48fe0f84a42955b80f47fda1a1bd45f5ee7d9fcacc44255ca6845a6

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\12Q77UU0\app-could-not-be-started[1].png

MD5
522037f008e03c9448ae0aaaf09e93cb

SHA1
8a32997eab79246beed5a37db0c92fbfb006bef2

SHA256
983c35607c4fb0b529ca732be42115d3fcaac947cee9c9632f7cacdbdecaf5a7

SHA512
643ec613b2e7bdbb2f61e1799c189b0e3392ea5ae10845eb0b1f1542a03569e886f4b54d5b38af10e78db49c71357108c94589474b181f6a4573b86cf2d6f0d8

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\12Q77UU0\application-not-started[1].htm

MD5
b93f8396a8a2dfe9e3c21b56167d4929

SHA1
69a96c5db1c74c21b6e33e2243c24cea0521a471

SHA256
f7c22889ec11c106ac833d5802e755b00500be32f1863050ecd13298791377d1

SHA512
665a9714e5b04e362c04d25e0e33a846191f99de446489f7df5ea1582340250d3cb008d2bec9f9d0f9f4c13a78112c5cd1b3d2be84958eb210d5b755b1a7df8a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\12Q77UU0\docons.2e4974ff[1].woff2

MD5
8f5dd9a59b2085224a61a65bcf628883

SHA1
46e0d208a432636cc7c3e4d306a2f189941053f0

SHA256
19d065ad4470800df127ab06d2fe32dd9570c099dcfd4664ac9de9b66ce68703

SHA512
9202775b6f7f6f1622f7ee4c1326bd547de1e69664718a0ae414e0112d81a63415b7109529ee2a4b06d7d3072730f909ebd2636f77392dd6a55d2012bcc1c4a1

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\12Q77UU0\ms.jsll-3.min[1].js

MD5
6d27324aadadac5dd57dd14f942870a2

SHA1
ca4c761f19c15f9252f443b921aa800996980751

SHA256
7a05a878ebad7153b928d6a0e9f5b5e78fb356ffbe6c2f311adf46452ec5a7ea

SHA512
c3ab55b6b1cb22d4b3db37f010bf28c4ecaa6c22401ceab0164bdb49ece11e5e80d7ee7d83abbb4703da690574aa68c21e0a21c9f1f5ec3dca3aede685c6f1b8

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\12Q77UU0\repair-tool-recommended-changes[1].png

MD5
3062488f9d119c0d79448be06ed140d8

SHA1
8a148951c894fc9e968d3e46589a2e978267650e

SHA256
c47a383de6dd60149b37dd24825d42d83cb48be0ed094e3fc3b228d0a7bb9332

SHA512
00bba6bcbfbf44b977129594a47f732809dce7d4e2d22d050338e4eea91fcc02a9b333c45eeb4c9024df076cbda0b46b621bf48309c0d037d19bbeae0367f5ed

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\532GFIBW\5cce29c0.deprecation[1].js

MD5
55bb21475c9d3a6d3c00f2c26a075e7d

SHA1
59696ef8addd5cfb642ad99521a8aed9420e0859

SHA256
3ceddaf5a1ed02614ec6b4edd5881a3ffb7ec08116154dff8eb9897230bf5e59

SHA512
35261ddaf86da82d27a29f39a7c6074a5f0e66f5b0a8098c7502289fb70b186371a7fe71410baab6cc6b726e9338afecee9f8bb075047a055723fb5e2f09b9c7

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\532GFIBW\MathJax[1].js

MD5
7a3737a82ea79217ebe20f896bceb623

SHA1
96b575bbae7dac6a442095996509b498590fbbf7

SHA256
002a60f162fd4d3081f435860d408ffce6f6ef87398f75bd791cadc8dae0771d

SHA512
e0d1f62bae160008e486a6f4ef8b57aa74c1945980c00deb37b083958f4291f0a47b994e5fdb348c2d4618346b93636ce4c323c6f510ab2fbd7a6547359d28d5

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\532GFIBW\TeX-AMS_CHTML[1].js

MD5
a7d2b67197a986636d79842a081ea85e

SHA1
b5e05ef7d8028a2741ec475f21560cf4e8cb2136

SHA256
9e0394a3a7bf16a1effb14fcc5557be82d9b2d662ba83bd84e303b4bdf791ef9

SHA512
ad234df68e34eb185222c24c30b384201f1e1793ad6c3dca2f54d510c7baa67eabdc39225f10e6b783757c0db859ce2ea32d6e78317c30a02d1765aee9f07109

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\532GFIBW\install-3-5[1].png

MD5
f6ec97c43480d41695065ad55a97b382

SHA1
d9c3d0895a5ed1a3951b8774b519b8217f0a54c5

SHA256
07a599fab1e66babc430e5fed3029f25ff3f4ea2dd0ec8968ffba71ef1872f68

SHA512
22462763178409d60609761a2af734f97b35b9a818ec1fd9046afab489aad83ce34896ee8586efe402ea7739ecf088bc2db5c1c8e4fb39e6a0fc5b3adc6b4a9b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7QOPJYB6\12971179[1].jpg

MD5
0e4994ae0e03d9611e7655286675f156

SHA1
e650534844a7197b328371318f288ae081448a97

SHA256
07b979b12f1cb506df7675efe227a2e78accfa1f5954af2b7bb66295e5cf881c

SHA512
07aaae5347fa8e82f86d0ba7c28127fac952d84bad3dce119654b5ba1cd2550c8d064770473f34f89fc383847b2f1594b3600d9fd01e6275d67868c41638e34a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7QOPJYB6\24882762[1].jpg

MD5
ca711d527e0e1be012a3105699592812

SHA1
f02534ce002f6d734a897491a1ebcc825da565c7

SHA256
e68e548a3cc404e84af3fd7529c21d64a238ba5d0857feb8fa1652b439b36e6f

SHA512
a56a1266a76ee7c95424f5beaed9d65ea569e7d187beae3c4bc1fb3a018ac728f419a2b08b62c51a70e18ee82d54e1d7714092e609135bb455060ab7d01830b5

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7QOPJYB6\2672110[1].png

MD5
7dc91895d24c825c361387611f6593e9

SHA1
fc0d26031ba690ac7748c759c35005fe627beb8f

SHA256
f37ad9b56d806d06267f9a290196dfe4200edb7729b41d789b8f1ec8adc5cdbf

SHA512
ba27fdbf02294cc78ede7972f20da383c20027ab172a4ea6ad5006ff58e404032d92f875e642dfe73985428c28bbbe1befc546c2666a672afacf23195425d7c2

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7QOPJYB6\31348972[1].jpg

MD5
c09597bbae67e58e38228f9e8fa06175

SHA1
85aec568955ad5d9165364d37a9a141dd899eca9

SHA256
f62142fd084d46df32d9d8a340855fcb17b14376c36549b825670451ea7cae73

SHA512
b7592dcf34487e3ddbffd32e8d03cb5665330f8f687e10f39f16c67673238e340cf4633b8e921932c65e3c891286349378bb70ad9a8026046653c4cf8fa2efff

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7QOPJYB6\a41151f6.site-ltr[1].css

MD5
8ef2904f90283cc102aa724dae48cbd9

SHA1
bd1444762ffed4870bc82e3c07b59a99e5041f55

SHA256
c0ef10ffdaaa66b1135cb1d6b4c60eb0bb894624ed1de58531e930c0185f3f37

SHA512
04ac0f769f7cb2bad40629f59b5bcd35aad1a7d9d3d704856ff7b6fa334bc84c9f01d5eee51a33001e1a353067536b5bb4215cc5544cb67ad36c193d5a525783

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7QOPJYB6\repair-tool-changes-complete[1].png

MD5
512625cf8f40021445d74253dc7c28c0

SHA1
f6b27ce0f7d4e48e34fddca8a96337f07cffe730

SHA256
1d4dcee8511d5371fec911660d6049782e12901c662b409a5c675772e9b87369

SHA512
ae02319d03884d758a86c286b6f593bdffd067885d56d82eeb8215fdcb41637c7bb9109039e7fbc93ad246d030c368fb285b3161976ed485abc5a8df6df9a38c

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7QOPJYB6\repair-tool-no-resolution[1].png

MD5
240c4cc15d9fd65405bb642ab81be615

SHA1
5a66783fe5dd932082f40811ae0769526874bfd3

SHA256
030272ce6ba1beca700ec83fded9dbdc89296fbde0633a7f5943ef5831876c07

SHA512
267fe31bc25944dd7b6071c2c2c271ccc188ae1f6a0d7e587dcf9198b81598da6b058d1b413f228df0cb37c8304329e808089388359651e81b5f3dec566d0ee0

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ZI978FIV\9467e933.index-docs[1].js

MD5
844dd145f3e8c22330215d7f982c1d6a

SHA1
468e6501ed80ab651dc7d1f7937160bd66792c64

SHA256
fc344f865f287282fd43a45c69797161d16ad45342e60a2d3caa33319d599b26

SHA512
86af5cd059c3849555b1f94fc9353ae0e3a5a62dc377b6e737fc4e875c2065af0fd9272185d38ef6552d7d571d372fd171ba0bedd88f319b8923f24dda51b544

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ZI978FIV\SegoeUI-Roman-VF_web[1].woff2

MD5
bca97218dca3cb15ce0284cbcb452890

SHA1
635298cbbd72b74b1762acc7dad6c79de4b3670d

SHA256
63c12051016796d92bcf4bc20b4881057475e6dfa4937c29c9e16054814ab47d

SHA512
6e850842d1e353a5457262c5c78d20704e8bd24b532368ba5e5dfc7a4b63059d536296b597fd3ccbd541aa8f89083a79d50aaa1b5e65b4d23fc37bfd806f0545

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ZI978FIV\latest[1].woff2

MD5
2835ee281b077ca8ac7285702007c894

SHA1
2e3d4d912aaf1c3f1f30d95c2c4fcea1b7bbc29a

SHA256
e172a02b68f977a57a1690507df809db1e43130f0161961709a36dbd70b4d25f

SHA512
80881c074df064795f9cc5aa187bea92f0e258bf9f6b970e61e9d50ee812913bf454cecbe7fd9e151bdaef700ce68253697f545ac56d4e7ef7ade7814a1dbc5a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ZI978FIV\wcp-consent[1].js

MD5
38b769522dd0e4c2998c9034a54e174e

SHA1
d95ef070878d50342b045dcf9abd3ff4cca0aaf3

SHA256
208edbed32b2adac9446df83caa4a093a261492ba6b8b3bcfe6a75efb8b70294

SHA512
f0a10a4c1ca4bac8a2dbd41f80bbe1f83d767a4d289b149e1a7b6e7f4dba41236c5ff244350b04e2ef485fdf6eb774b9565a858331389ca3cb474172465eb3ef

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\74WMPWYY.cookie

MD5
08cdc08b845a4dc6a1d9825fe00533d6

SHA1
01fedd6628d029d80d78534e8232a00bcfa40918

SHA256
6c7959768b4907fb22a97311b2a265c5dda4185ead0ccbd527ded1593e85cbb2

SHA512
623c677c47382f5ea6381e82ba8aab64913581bef93cb2b396fe4c3e17fb532401c39715a2aac7dc0ea8630e4bb9a5fae29887d198ac13f836e8ea9594e31f33

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\12B578593FDE07EC53D020B1D5DEBF3B_5D74C2DB556F94499BCD6D74A36958A3

MD5
71502b1cbaa8682011c612cf3cd3f7f2

SHA1
ce1b12284d9c2ea59a654a2050c958db3c22b09a

SHA256
c180f56791a473dabdc261ee744cd545be202d5748630fb16ac6fc55792091b7

SHA512
f2626f081c4fae196ac81c2cb69b1460a1c160001e8479b5aef31c36e5ffa3b9d39217e82aabddc8f411ba86261bb94cdc7359fe2dd4bb7376876a80ab545756

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\2A7611428D62805A3E4E5BC4103D82E4_D0FA13DADFB59BDF00C474952E166CC1

MD5
594332240a1798e43823100d3887f3f3

SHA1
9a706712b11b452689be5b45ae00fa763a24a6cc

SHA256
81eca01b1e08628003bcd84307b56190964894f69e49aa474e30b1c609205940

SHA512
59345679bcaf1ed42e81561b6ecea6043506a4a5e61aadbfbe5d7091dbdf5c3a4ff411529dc711a37cfa503c20f7a54d8412d8b00055d3e668b68607e3a2b90e

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63

MD5
c3246018681a073e47bebd589ef02e99

SHA1
0fe33de1f24dfb3a7cc26d49930bd376e10c521d

SHA256
cc59cd944e9352d44118eb3ac2f618d33ba152ce8f32b1602cdd6972fd4de11c

SHA512
7dbfd77622372cd683311ef70ea8e2081df64ca0fe6602341b3ba1df498c5fa2dac882676ca174c7a1c273f1448430fec1b0e12a9b3bf9294cee4d5db678b480

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868

MD5
b174ee70a656d3c90a6aaee80f21d412

SHA1
cfb36fb06c944ad330c94e753f0b1bce8278e92b

SHA256
1d5ffbc87a69676b5740823a757fabef8ed72ed45220f1a280cac9e4dc7d1e71

SHA512
219f41f995238379fac5e3a164d5592246a9a1455cb7e4d0c58ffb45b2c3f27edc0f58b8d06019ff6a4b43c5a604f7b398d24c129aef9c6f2dddb7c47c4d7876

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB

MD5
a68f2c97e811b23dcffda759f104c980

SHA1
30020fe610682b9bca672889eb334995004d487d

SHA256
99a199840d9ca52b7147524fccd693fbadc5245226324710a00ab0647c0decc8

SHA512
09d082d4b67588f0d96dea0981b73412c1b2370642392dc7f0c77f8aa8a7cdcc5b302b03e546a79dd6b2ce007042e45e7b4d2fd1271b4c1c879e5c0b70aefdcf

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\12B578593FDE07EC53D020B1D5DEBF3B_5D74C2DB556F94499BCD6D74A36958A3

MD5
c98fc5758df6b016bfa9e3b25cb017bf

SHA1
3a8cf27acca357697166bd17be66a18052d9e690

SHA256
762f5f762cb7ef8712a27ea49fe453943a8bb700b76eaa7ffa3d83fb8ea3624f

SHA512
97e30c0506b9ebc1e431e83cefb3a561acb988eda79a15a137367edeba6798359753a5dc78601bb7ee56473599541c8a6fcb9f9c4399f42b7aca8044dbfd70fa

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\2A7611428D62805A3E4E5BC4103D82E4_D0FA13DADFB59BDF00C474952E166CC1

MD5
54de0ee38ce00f4e578ab45b0f975882

SHA1
8dd9ca55bfa1e5546ad3c912bd182b14a3f08153

SHA256
f76cc2a149b8f83734135c033ead3792ec7dc5afc7a60375e9799c45c9e39db9

SHA512
b0e60944e0cec12015c823f08ff2d63596a6719ca914bc71d96b0a77eddef53b26f7c876ae4c40036c0878d6413fc2c300084a8a8e52e1f479b022ed48d9f4a2

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63

MD5
62015fed5b64b6d1817550855ab27f26

SHA1
f689f0ad8f441197d56c90e598333239fa59c2c4

SHA256
77084179a5436b8516cbc06c487fc8a5b2c4e192d56051f8de155316292370c6

SHA512
cba13686d0c803e3a893a02e1f5a63c7f5141357af41f0eda6421ed3b2027de7a8025e632903f0ff6d61ea91cdec18deb16101b8b20bd3c750ceef3fd956e64c

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868

MD5
9680a6fe61a69dafad9af9cfbbeb710e

SHA1
fde55baff2418e2e0a3849aff626dd6bbb468c25

SHA256
8fec9368c7023eef223d4b75dd1ed509828817acf855c498d1ac4f04701b0c61

SHA512
914c929ab5c9cfa349576bfdddeb3b9dda83c80c656e8be52dd87892a4857f8b2d1b6011ad106b0f38e55d5806eea363984c867027c086bafa107067f3d3de88

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB

MD5
0338e563209a9c7595d5a332bacaa073

SHA1
db85bb0fc398b886a2c1a206c2a3e44c23865209

SHA256
fa2cf1bb271586d3075f654ded2982f2debb0deca8305b700c4c8fb50ef95a56

SHA512
514fcd08b523abd2683b30f7538a1b84b2e9d59b3ad0d85cef67fac7f7ff47c21acd39cc1d45af21c5035ef71c55b29f7818bd9275a9a8530242bc6f9d61f08a

Download Submit
memory/532-114-0x00000000008F0000-0x00000000008F1000-memory.dmp

Filesize
4KB

Download
memory/532-1154-0x0000000000FD0000-0x0000000000FD1000-memory.dmp

Filesize
4KB

Download
memory/688-144-0x0000000008D40000-0x0000000008D41000-memory.dmp

Filesize
4KB

Download
memory/688-123-0x0000000006D20000-0x0000000006D21000-memory.dmp

Filesize
4KB

Download
memory/688-116-0x0000000000000000-mapping.dmp

Download
memory/688-117-0x0000000000910000-0x0000000000911000-memory.dmp

Filesize
4KB

Download
memory/688-118-0x0000000000910000-0x0000000000911000-memory.dmp

Filesize
4KB

Download
memory/688-119-0x0000000000E30000-0x0000000000E31000-memory.dmp

Filesize
4KB

Download
memory/688-120-0x0000000006E30000-0x0000000006E31000-memory.dmp

Filesize
4KB

Download
memory/688-122-0x0000000000DE2000-0x0000000000DE3000-memory.dmp

Filesize
4KB

Download
memory/688-121-0x0000000000DE0000-0x0000000000DE1000-memory.dmp

Filesize
4KB

Download
memory/688-124-0x0000000006DC0000-0x0000000006DC1000-memory.dmp

Filesize
4KB

Download
memory/688-125-0x0000000007560000-0x0000000007561000-memory.dmp

Filesize
4KB

Download
memory/688-126-0x00000000075D0000-0x00000000075D1000-memory.dmp

Filesize
4KB

Download
memory/688-570-0x0000000000DE6000-0x0000000000DE8000-memory.dmp

Filesize
8KB

Download
memory/688-188-0x0000000000DE3000-0x0000000000DE4000-memory.dmp

Filesize
4KB

Download
memory/688-151-0x0000000009060000-0x0000000009061000-memory.dmp

Filesize
4KB

Download
memory/688-150-0x000000007E3D0000-0x000000007E3D1000-memory.dmp

Filesize
4KB

Download
memory/688-149-0x0000000008EB0000-0x0000000008EB1000-memory.dmp

Filesize
4KB

Download
memory/688-137-0x0000000008D80000-0x0000000008DB3000-memory.dmp

Filesize
204KB

Download
memory/688-130-0x0000000000910000-0x0000000000911000-memory.dmp

Filesize
4KB

Download
memory/688-129-0x0000000007DA0000-0x0000000007DA1000-memory.dmp

Filesize
4KB

Download
memory/688-128-0x0000000007BB0000-0x0000000007BB1000-memory.dmp

Filesize
4KB

Download
memory/688-127-0x0000000007AA0000-0x0000000007AA1000-memory.dmp

Filesize
4KB

Download
memory/1148-1158-0x000000000042FC39-mapping.dmp

Download
memory/1148-1161-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1156-677-0x0000000000000000-mapping.dmp

Download
memory/1156-684-0x0000000007310000-0x0000000007311000-memory.dmp

Filesize
4KB

Download
memory/1156-687-0x0000000007312000-0x0000000007313000-memory.dmp

Filesize
4KB

Download
memory/1156-722-0x0000000007313000-0x0000000007314000-memory.dmp

Filesize
4KB

Download
memory/1156-724-0x0000000007314000-0x0000000007316000-memory.dmp

Filesize
8KB

Download
memory/1156-1090-0x0000000007316000-0x0000000007317000-memory.dmp

Filesize
4KB

Download
memory/2304-1165-0x0000000000405D3E-mapping.dmp

Download
memory/3624-1160-0x0000000000405D3E-mapping.dmp

Download
memory/4004-676-0x0000000000000000-mapping.dmp

Download
memory/4452-1200-0x0000000000405D3E-mapping.dmp

Download
memory/4880-1204-0x0000000000405D3E-mapping.dmp

Download