redline | 2f2d4587b0faf105a6d992856d7a92c03f599b68b84bd41b8c2cb32419b90a47

Analysis

max time kernel
149s
max time network
151s
platform
windows10-1703_x64
resource
win10-20220718-en
resource tags

arch:x64arch:x86image:win10-20220718-enlocale:en-usos:windows10-1703-x64system
submitted
12-08-2022 05:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2f2d4587b0faf105a6d992856d7a92c03f599b68b84bd41b8c2cb32419b90a47.exe
Size

907KB
MD5

36f9f1d6c34e3277fd8e4de52ffa1f5f
SHA1

579c4e71f6f22f224195da1fd7bed927bcb0f990
SHA256

2f2d4587b0faf105a6d992856d7a92c03f599b68b84bd41b8c2cb32419b90a47
SHA512

45b90fc788c797f5526e5db190ec32a77a2c1ed5c135914c0a7d829dfafb553bef84d3084a1c27f4c65c388f438681ae17bb3e9cb006e6108698f93737dc409f

Score

10^/10

redline 5 5076357887 @tag12312341 nam3 ruxarr_gg discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

nam3

103.89.90.61:34589

Attributes

auth_value
64b900120bbceaa6a9c60e9079492895

Extracted

Family

redline

Botnet

176.113.115.146:9582

Attributes

auth_value
d38b30c1ccd6c1e5088d9e5bd9e51b0f

Extracted

Family

redline

Botnet

RuXaRR_GG

insttaller.com:40915

Attributes

auth_value
4a733ff307847db3ee220c11d113a305

Extracted

Family

redline

Botnet

5076357887

195.54.170.157:16525

Attributes

auth_value
0dfaff60271d374d0c206d19883e06f3

Extracted

Family

redline

Botnet

@tag12312341

62.204.41.144:14096

Attributes

auth_value
71466795417275fac01979e57016e277

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 15 IoCs

Processes:

resource	yara_rule
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\safert44.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\jshainx.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\tag.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\safert44.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\tag.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\jshainx.exe	family_redline
behavioral1/memory/4816-617-0x0000000000770000-0x0000000000790000-memory.dmp	family_redline
behavioral1/memory/4888-640-0x0000000000BE0000-0x0000000000C24000-memory.dmp	family_redline
behavioral1/memory/4912-650-0x0000000000200000-0x0000000000220000-memory.dmp	family_redline
behavioral1/memory/4956-669-0x0000000000470000-0x0000000000490000-memory.dmp	family_redline
behavioral1/memory/4996-664-0x0000000000610000-0x0000000000630000-memory.dmp	family_redline

Executes dropped EXE 10 IoCs

Processes:

F0geI.exekukurzka9000.exenamdoitntn.exereal.exesafert44.exetag.exejshainx.exeffnameedit.exerawxdev.exeme.exe

pid	process
4760	F0geI.exe
4788	kukurzka9000.exe
4816	namdoitntn.exe
4840	real.exe
4888	safert44.exe
4912	tag.exe
4956	jshainx.exe
4996	ffnameedit.exe
5040	rawxdev.exe
5096	me.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2f2d4587b0faf105a6d992856d7a92c03f599b68b84bd41b8c2cb32419b90a47.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000\Control Panel\International\Geo\Nation	2f2d4587b0faf105a6d992856d7a92c03f599b68b84bd41b8c2cb32419b90a47.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 10 IoCs

Processes:

2f2d4587b0faf105a6d992856d7a92c03f599b68b84bd41b8c2cb32419b90a47.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	2f2d4587b0faf105a6d992856d7a92c03f599b68b84bd41b8c2cb32419b90a47.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\F0geI.exe	2f2d4587b0faf105a6d992856d7a92c03f599b68b84bd41b8c2cb32419b90a47.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\real.exe	2f2d4587b0faf105a6d992856d7a92c03f599b68b84bd41b8c2cb32419b90a47.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\safert44.exe	2f2d4587b0faf105a6d992856d7a92c03f599b68b84bd41b8c2cb32419b90a47.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\tag.exe	2f2d4587b0faf105a6d992856d7a92c03f599b68b84bd41b8c2cb32419b90a47.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\jshainx.exe	2f2d4587b0faf105a6d992856d7a92c03f599b68b84bd41b8c2cb32419b90a47.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	2f2d4587b0faf105a6d992856d7a92c03f599b68b84bd41b8c2cb32419b90a47.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\rawxdev.exe	2f2d4587b0faf105a6d992856d7a92c03f599b68b84bd41b8c2cb32419b90a47.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\me.exe	2f2d4587b0faf105a6d992856d7a92c03f599b68b84bd41b8c2cb32419b90a47.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe	2f2d4587b0faf105a6d992856d7a92c03f599b68b84bd41b8c2cb32419b90a47.exe

Drops file in Windows directory 11 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5176 4840 WerFault.exe real.exe

pid	pid_target	process	target process
5176	4840	WerFault.exe	real.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

real.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	real.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	real.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

MicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 0000000000000000	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CRLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\NextUpdateDate = "367102068"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify.	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DOMStorage	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$blogger	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\NextUpdateDate = "367070077"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\Certificates\AA549154B737EF29C55	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 25629e421baed801	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 42bc034f1baed801	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\NextUpdateDate = "367053483"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar\WebBrowser	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. = 0100000084faf3dc36bf612726fd70be699f69bf8ca47cae2ad1fcfd439740a1f960580acdafd77d5dbfb5e0be9cf7e2b0e0aff23f809279a75d4f9139915f9284926b9060ba8dd385c0265920396b814b4cd2cd52170091167a5f8961fc	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\InternetRegistry	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IntelliForms	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 342c46421baed801	MicrosoftEdge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

real.exejshainx.exeffnameedit.exetag.exesafert44.exenamdoitntn.exe

pid	process
4840	real.exe
4840	real.exe
4956	jshainx.exe
4956	jshainx.exe
4996	ffnameedit.exe
4996	ffnameedit.exe
4912	tag.exe
4912	tag.exe
4888	safert44.exe
4888	safert44.exe
4816	namdoitntn.exe
4816	namdoitntn.exe

Suspicious behavior: MapViewOfSection 8 IoCs

Processes:

MicrosoftEdgeCP.exe

pid	process
1368	MicrosoftEdgeCP.exe
1368	MicrosoftEdgeCP.exe
1368	MicrosoftEdgeCP.exe
1368	MicrosoftEdgeCP.exe
1368	MicrosoftEdgeCP.exe
1368	MicrosoftEdgeCP.exe
1368	MicrosoftEdgeCP.exe
1368	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exejshainx.exeffnameedit.exetag.exesafert44.exenamdoitntn.exe

description	pid	process
Token: SeDebugPrivilege	1552	MicrosoftEdge.exe
Token: SeDebugPrivilege	1552	MicrosoftEdge.exe
Token: SeDebugPrivilege	1552	MicrosoftEdge.exe
Token: SeDebugPrivilege	1552	MicrosoftEdge.exe
Token: SeDebugPrivilege	1336	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1336	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1336	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1336	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	5624	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	5624	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4956	jshainx.exe
Token: SeDebugPrivilege	4996	ffnameedit.exe
Token: SeDebugPrivilege	4912	tag.exe
Token: SeDebugPrivilege	4888	safert44.exe
Token: SeDebugPrivilege	4816	namdoitntn.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exe

pid process

1552 MicrosoftEdge.exe
1368 MicrosoftEdgeCP.exe
1368 MicrosoftEdgeCP.exe

pid	process
1552	MicrosoftEdge.exe
1368	MicrosoftEdgeCP.exe
1368	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

2f2d4587b0faf105a6d992856d7a92c03f599b68b84bd41b8c2cb32419b90a47.exeMicrosoftEdgeCP.exe

description	pid	process	target process
PID 4020 wrote to memory of 4760	4020	2f2d4587b0faf105a6d992856d7a92c03f599b68b84bd41b8c2cb32419b90a47.exe	F0geI.exe
PID 4020 wrote to memory of 4760	4020	2f2d4587b0faf105a6d992856d7a92c03f599b68b84bd41b8c2cb32419b90a47.exe	F0geI.exe
PID 4020 wrote to memory of 4760	4020	2f2d4587b0faf105a6d992856d7a92c03f599b68b84bd41b8c2cb32419b90a47.exe	F0geI.exe
PID 4020 wrote to memory of 4788	4020	2f2d4587b0faf105a6d992856d7a92c03f599b68b84bd41b8c2cb32419b90a47.exe	kukurzka9000.exe
PID 4020 wrote to memory of 4788	4020	2f2d4587b0faf105a6d992856d7a92c03f599b68b84bd41b8c2cb32419b90a47.exe	kukurzka9000.exe
PID 4020 wrote to memory of 4788	4020	2f2d4587b0faf105a6d992856d7a92c03f599b68b84bd41b8c2cb32419b90a47.exe	kukurzka9000.exe
PID 4020 wrote to memory of 4816	4020	2f2d4587b0faf105a6d992856d7a92c03f599b68b84bd41b8c2cb32419b90a47.exe	namdoitntn.exe
PID 4020 wrote to memory of 4816	4020	2f2d4587b0faf105a6d992856d7a92c03f599b68b84bd41b8c2cb32419b90a47.exe	namdoitntn.exe
PID 4020 wrote to memory of 4816	4020	2f2d4587b0faf105a6d992856d7a92c03f599b68b84bd41b8c2cb32419b90a47.exe	namdoitntn.exe
PID 4020 wrote to memory of 4840	4020	2f2d4587b0faf105a6d992856d7a92c03f599b68b84bd41b8c2cb32419b90a47.exe	real.exe
PID 4020 wrote to memory of 4840	4020	2f2d4587b0faf105a6d992856d7a92c03f599b68b84bd41b8c2cb32419b90a47.exe	real.exe
PID 4020 wrote to memory of 4840	4020	2f2d4587b0faf105a6d992856d7a92c03f599b68b84bd41b8c2cb32419b90a47.exe	real.exe
PID 4020 wrote to memory of 4888	4020	2f2d4587b0faf105a6d992856d7a92c03f599b68b84bd41b8c2cb32419b90a47.exe	safert44.exe
PID 4020 wrote to memory of 4888	4020	2f2d4587b0faf105a6d992856d7a92c03f599b68b84bd41b8c2cb32419b90a47.exe	safert44.exe
PID 4020 wrote to memory of 4888	4020	2f2d4587b0faf105a6d992856d7a92c03f599b68b84bd41b8c2cb32419b90a47.exe	safert44.exe
PID 4020 wrote to memory of 4912	4020	2f2d4587b0faf105a6d992856d7a92c03f599b68b84bd41b8c2cb32419b90a47.exe	tag.exe
PID 4020 wrote to memory of 4912	4020	2f2d4587b0faf105a6d992856d7a92c03f599b68b84bd41b8c2cb32419b90a47.exe	tag.exe
PID 4020 wrote to memory of 4912	4020	2f2d4587b0faf105a6d992856d7a92c03f599b68b84bd41b8c2cb32419b90a47.exe	tag.exe
PID 4020 wrote to memory of 4956	4020	2f2d4587b0faf105a6d992856d7a92c03f599b68b84bd41b8c2cb32419b90a47.exe	jshainx.exe
PID 4020 wrote to memory of 4956	4020	2f2d4587b0faf105a6d992856d7a92c03f599b68b84bd41b8c2cb32419b90a47.exe	jshainx.exe
PID 4020 wrote to memory of 4956	4020	2f2d4587b0faf105a6d992856d7a92c03f599b68b84bd41b8c2cb32419b90a47.exe	jshainx.exe
PID 4020 wrote to memory of 4996	4020	2f2d4587b0faf105a6d992856d7a92c03f599b68b84bd41b8c2cb32419b90a47.exe	ffnameedit.exe
PID 4020 wrote to memory of 4996	4020	2f2d4587b0faf105a6d992856d7a92c03f599b68b84bd41b8c2cb32419b90a47.exe	ffnameedit.exe
PID 4020 wrote to memory of 4996	4020	2f2d4587b0faf105a6d992856d7a92c03f599b68b84bd41b8c2cb32419b90a47.exe	ffnameedit.exe
PID 4020 wrote to memory of 5040	4020	2f2d4587b0faf105a6d992856d7a92c03f599b68b84bd41b8c2cb32419b90a47.exe	rawxdev.exe
PID 4020 wrote to memory of 5040	4020	2f2d4587b0faf105a6d992856d7a92c03f599b68b84bd41b8c2cb32419b90a47.exe	rawxdev.exe
PID 4020 wrote to memory of 5040	4020	2f2d4587b0faf105a6d992856d7a92c03f599b68b84bd41b8c2cb32419b90a47.exe	rawxdev.exe
PID 4020 wrote to memory of 5096	4020	2f2d4587b0faf105a6d992856d7a92c03f599b68b84bd41b8c2cb32419b90a47.exe	me.exe
PID 4020 wrote to memory of 5096	4020	2f2d4587b0faf105a6d992856d7a92c03f599b68b84bd41b8c2cb32419b90a47.exe	me.exe
PID 4020 wrote to memory of 5096	4020	2f2d4587b0faf105a6d992856d7a92c03f599b68b84bd41b8c2cb32419b90a47.exe	me.exe
PID 1368 wrote to memory of 2940	1368	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1368 wrote to memory of 2940	1368	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1368 wrote to memory of 2940	1368	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1368 wrote to memory of 2940	1368	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1368 wrote to memory of 4036	1368	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1368 wrote to memory of 4036	1368	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1368 wrote to memory of 4036	1368	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1368 wrote to memory of 4036	1368	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1368 wrote to memory of 4292	1368	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1368 wrote to memory of 4292	1368	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1368 wrote to memory of 4292	1368	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1368 wrote to memory of 4292	1368	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1368 wrote to memory of 4532	1368	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1368 wrote to memory of 4532	1368	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1368 wrote to memory of 4532	1368	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1368 wrote to memory of 4532	1368	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1368 wrote to memory of 5080	1368	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1368 wrote to memory of 5080	1368	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1368 wrote to memory of 5080	1368	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1368 wrote to memory of 5080	1368	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe

C:\Users\Admin\AppData\Local\Temp\2f2d4587b0faf105a6d992856d7a92c03f599b68b84bd41b8c2cb32419b90a47.exe
"C:\Users\Admin\AppData\Local\Temp\2f2d4587b0faf105a6d992856d7a92c03f599b68b84bd41b8c2cb32419b90a47.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4020

C:\Program Files (x86)\Company\NewProduct\F0geI.exe
"C:\Program Files (x86)\Company\NewProduct\F0geI.exe"
2⤵
- Executes dropped EXE
PID:4760

C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe
"C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe"
2⤵
- Executes dropped EXE
PID:4788

C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe
"C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4816

C:\Program Files (x86)\Company\NewProduct\real.exe
"C:\Program Files (x86)\Company\NewProduct\real.exe"
2⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:4840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 1252
3⤵
- Program crash
PID:5176

C:\Program Files (x86)\Company\NewProduct\safert44.exe
"C:\Program Files (x86)\Company\NewProduct\safert44.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4888

C:\Program Files (x86)\Company\NewProduct\tag.exe
"C:\Program Files (x86)\Company\NewProduct\tag.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4912

C:\Program Files (x86)\Company\NewProduct\jshainx.exe
"C:\Program Files (x86)\Company\NewProduct\jshainx.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4956

C:\Program Files (x86)\Company\NewProduct\me.exe
"C:\Program Files (x86)\Company\NewProduct\me.exe"
2⤵
- Executes dropped EXE
PID:5096

C:\Program Files (x86)\Company\NewProduct\rawxdev.exe
"C:\Program Files (x86)\Company\NewProduct\rawxdev.exe"
2⤵
- Executes dropped EXE
PID:5040

C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe
"C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4996

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1552

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:784

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1368

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1336

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:3636

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:2940

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
PID:4036

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4292

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4532

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:3328

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:5080

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\295e5e13cc9949c3a1f681e554d79977 /t 0 /p 3328
1⤵
PID:6040

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:5336

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5624

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:5820

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5444

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Company\NewProduct\F0geI.exe
Filesize
339KB

MD5
501e0f6fa90340e3d7ff26f276cd582e

SHA1
1bce4a6153f71719e786f8f612fbfcd23d3e130a

SHA256
f07d918c6571f11abf9ab7268ac6e2ecbcd931c3d9d878895c777d15052aae2b

SHA512
dee3aabfca7912f15b628253222cfe8d8e13cd64f0438e8d705b68b0a14b4c9523b7a207583be7b424e444d6b05f237484a0c38bf2e075d347ef937d409a3a69

Download Submit
C:\Program Files (x86)\Company\NewProduct\F0geI.exe
Filesize
339KB

MD5
501e0f6fa90340e3d7ff26f276cd582e

SHA1
1bce4a6153f71719e786f8f612fbfcd23d3e130a

SHA256
f07d918c6571f11abf9ab7268ac6e2ecbcd931c3d9d878895c777d15052aae2b

SHA512
dee3aabfca7912f15b628253222cfe8d8e13cd64f0438e8d705b68b0a14b4c9523b7a207583be7b424e444d6b05f237484a0c38bf2e075d347ef937d409a3a69

Download Submit
C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe
Filesize
107KB

MD5
4bf892a854af9af2802f526837819f6e

SHA1
09f2e9938466e74a67368ecd613efdc57f80c30b

SHA256
713eeb4e9271fe4b15160d900ad78498838bb33f7f97ad544a705ab2a46d97cf

SHA512
7ef9d8cb4daf6be60c5a41439dab4e7384676b34de2341ac52cb33815645fbb51a4b78725ea97479d287a8d7a0a61b4b337b1ad49cce2a23c9192fd9b7678d44

Download Submit
C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe
Filesize
107KB

MD5
4bf892a854af9af2802f526837819f6e

SHA1
09f2e9938466e74a67368ecd613efdc57f80c30b

SHA256
713eeb4e9271fe4b15160d900ad78498838bb33f7f97ad544a705ab2a46d97cf

SHA512
7ef9d8cb4daf6be60c5a41439dab4e7384676b34de2341ac52cb33815645fbb51a4b78725ea97479d287a8d7a0a61b4b337b1ad49cce2a23c9192fd9b7678d44

Download Submit
C:\Program Files (x86)\Company\NewProduct\jshainx.exe
Filesize
107KB

MD5
2647a5be31a41a39bf2497125018dbce

SHA1
a1ac856b9d6556f5bb3370f0342914eb7cbb8840

SHA256
84c7458316adf09943e459b4fb1aa79bd359ec1516e0ad947f44bdc6c0931665

SHA512
68f70140af2ad71a40b6c884627047cdcbc92b4c6f851131e61dc9db3658bde99c1a09cad88c7c922aa5873ab6829cf4100dc12b75f237b2465e22770657ae26

Download Submit
C:\Program Files (x86)\Company\NewProduct\jshainx.exe
Filesize
107KB

MD5
2647a5be31a41a39bf2497125018dbce

SHA1
a1ac856b9d6556f5bb3370f0342914eb7cbb8840

SHA256
84c7458316adf09943e459b4fb1aa79bd359ec1516e0ad947f44bdc6c0931665

SHA512
68f70140af2ad71a40b6c884627047cdcbc92b4c6f851131e61dc9db3658bde99c1a09cad88c7c922aa5873ab6829cf4100dc12b75f237b2465e22770657ae26

Download Submit
C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe
Filesize
491KB

MD5
681d98300c552b8c470466d9e8328c8a

SHA1
d15f4a432a2abce96ba9ba74443e566c1ffb933f

SHA256
8bbc892aedc1424ca5c66677b465c826f867515a3fea28821d015edcee71c912

SHA512
b909975d0212d5a5a0cb2e2809ee02224aac729cb761be97a8e3be4ee0a1d7470946da8cf725953c1b2d71fb5fc9dc3c26fd74bce5db5cc0e91a106f8bded887

Download Submit
C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe
Filesize
491KB

MD5
681d98300c552b8c470466d9e8328c8a

SHA1
d15f4a432a2abce96ba9ba74443e566c1ffb933f

SHA256
8bbc892aedc1424ca5c66677b465c826f867515a3fea28821d015edcee71c912

SHA512
b909975d0212d5a5a0cb2e2809ee02224aac729cb761be97a8e3be4ee0a1d7470946da8cf725953c1b2d71fb5fc9dc3c26fd74bce5db5cc0e91a106f8bded887

Download Submit
C:\Program Files (x86)\Company\NewProduct\me.exe
Filesize
286KB

MD5
29f986a025ca64b6e5fbc50fcefc8743

SHA1
4930311ffe1eac17a468c454d2ac37532b79c454

SHA256
766033bd59297068c74324bfffca88887a4f02588bac347e277644011fb6b090

SHA512
7af798f1480c18952597699189eff78d2ac638b40bffbc651954807b81d667207dd6d4ad073a787d40a423a15361d625f49b556109f998d2c56fa66d71c7268a

Download Submit
C:\Program Files (x86)\Company\NewProduct\me.exe
Filesize
286KB

MD5
29f986a025ca64b6e5fbc50fcefc8743

SHA1
4930311ffe1eac17a468c454d2ac37532b79c454

SHA256
766033bd59297068c74324bfffca88887a4f02588bac347e277644011fb6b090

SHA512
7af798f1480c18952597699189eff78d2ac638b40bffbc651954807b81d667207dd6d4ad073a787d40a423a15361d625f49b556109f998d2c56fa66d71c7268a

Download Submit
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe
Filesize
107KB

MD5
bbd8ea73b7626e0ca5b91d355df39b7f

SHA1
66e298653beb7f652eb44922010910ced6242879

SHA256
1aa3fdc24e789b01a39944b85c99e4ac08864d2eae7530164cea2821acbf184e

SHA512
625cc9c108b4660030be1282493700e5f0ccfb973f466f61254ed1e1a96f5f042cdeaa94607825a2f694647468e2f525a6451542fe3aac785ebac1ccfe39864f

Download Submit
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe
Filesize
107KB

MD5
bbd8ea73b7626e0ca5b91d355df39b7f

SHA1
66e298653beb7f652eb44922010910ced6242879

SHA256
1aa3fdc24e789b01a39944b85c99e4ac08864d2eae7530164cea2821acbf184e

SHA512
625cc9c108b4660030be1282493700e5f0ccfb973f466f61254ed1e1a96f5f042cdeaa94607825a2f694647468e2f525a6451542fe3aac785ebac1ccfe39864f

Download Submit
C:\Program Files (x86)\Company\NewProduct\rawxdev.exe
Filesize
287KB

MD5
c1595ffe08cf9360cda3a95c2104d2d9

SHA1
7d2727bf305fd7ffcf4119f7d545b189135b06f6

SHA256
dc55684473d7a957277eb4dc82deab4cadc83bd21f2c9a6c4b1b3f579cc1b7f3

SHA512
8847577ecd6590fdc4dbd0447e8a990c8d8835e733106a3b910edf4ee4fbac4e1ca6b61468c8fdef83982e5bd347b21525dc605e6d596bb6f2ca940dab256619

Download Submit
C:\Program Files (x86)\Company\NewProduct\rawxdev.exe
Filesize
287KB

MD5
c1595ffe08cf9360cda3a95c2104d2d9

SHA1
7d2727bf305fd7ffcf4119f7d545b189135b06f6

SHA256
dc55684473d7a957277eb4dc82deab4cadc83bd21f2c9a6c4b1b3f579cc1b7f3

SHA512
8847577ecd6590fdc4dbd0447e8a990c8d8835e733106a3b910edf4ee4fbac4e1ca6b61468c8fdef83982e5bd347b21525dc605e6d596bb6f2ca940dab256619

Download Submit
C:\Program Files (x86)\Company\NewProduct\real.exe
Filesize
286KB

MD5
8a370815d8a47020150efa559ffdf736

SHA1
ba9d8df8f484b8da51161a0e29fd29e5001cff5d

SHA256
975457ed5ae0174f06cc093d4f9edcf75d88118cbbac5a1e76ad7bc7c679cd58

SHA512
d2eb60e220f64e76ebed2b051cc14f3a2da29707d8b2eb52fb41760800f11eafeb8bb3f1f8edcfca693a791aa60e56e263063f2b72abe4ad8784061feee6f7bf

Download Submit
C:\Program Files (x86)\Company\NewProduct\real.exe
Filesize
286KB

MD5
8a370815d8a47020150efa559ffdf736

SHA1
ba9d8df8f484b8da51161a0e29fd29e5001cff5d

SHA256
975457ed5ae0174f06cc093d4f9edcf75d88118cbbac5a1e76ad7bc7c679cd58

SHA512
d2eb60e220f64e76ebed2b051cc14f3a2da29707d8b2eb52fb41760800f11eafeb8bb3f1f8edcfca693a791aa60e56e263063f2b72abe4ad8784061feee6f7bf

Download Submit
C:\Program Files (x86)\Company\NewProduct\safert44.exe
Filesize
246KB

MD5
414ffd7094c0f50662ffa508ca43b7d0

SHA1
6ec67bd53da2ff3d5538a3afcc6797af1e5a53fb

SHA256
d3fb9c24b34c113992c5c658f6a11f9620da2e49d12d1acabe871e1bea7846ee

SHA512
c6527077b4822c062e32c39be06e285916b501a358991d120a469f5da1e13d282685ca7ca3fa938292d5beef073fbea42ff9ba96fa5c395f057f7c964608a399

Download Submit
C:\Program Files (x86)\Company\NewProduct\safert44.exe
Filesize
246KB

MD5
414ffd7094c0f50662ffa508ca43b7d0

SHA1
6ec67bd53da2ff3d5538a3afcc6797af1e5a53fb

SHA256
d3fb9c24b34c113992c5c658f6a11f9620da2e49d12d1acabe871e1bea7846ee

SHA512
c6527077b4822c062e32c39be06e285916b501a358991d120a469f5da1e13d282685ca7ca3fa938292d5beef073fbea42ff9ba96fa5c395f057f7c964608a399

Download Submit
C:\Program Files (x86)\Company\NewProduct\tag.exe
Filesize
107KB

MD5
2ebc22860c7d9d308c018f0ffb5116ff

SHA1
78791a83f7161e58f9b7df45f9be618e9daea4cd

SHA256
8e2c9fd68fc850fa610d1edfd46fc4a66adbef24e42a1841290b0e0c08597e89

SHA512
d4842627f6fab09f9472ed0b09b5e012524bf6b821d90a753275f68de65b7ba084a9e15daca58a183f89b166cc9d2d2f2d6a81e1110e66c5822b548279c8c05e

Download Submit
C:\Program Files (x86)\Company\NewProduct\tag.exe
Filesize
107KB

MD5
2ebc22860c7d9d308c018f0ffb5116ff

SHA1
78791a83f7161e58f9b7df45f9be618e9daea4cd

SHA256
8e2c9fd68fc850fa610d1edfd46fc4a66adbef24e42a1841290b0e0c08597e89

SHA512
d4842627f6fab09f9472ed0b09b5e012524bf6b821d90a753275f68de65b7ba084a9e15daca58a183f89b166cc9d2d2f2d6a81e1110e66c5822b548279c8c05e

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\2P398YJT.cookie
Filesize
424B

MD5
202c253d71e685f54795127c18355177

SHA1
00fd86258f50820954bcfbbdff6d157896b6ebfb

SHA256
4488fe140af321e2a33d33d601c828a4cb3a07b47eb68a5c91e27961e26339b3

SHA512
654504bfb7aadfde0465f1759095b2ba2e06879bfbb410f5c35ad74628155a243c8150bba274604371926d86c70a884e7ef51e015aeb519e47a33dd4c7ebdb33

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\GGN3EGRI.cookie
Filesize
256B

MD5
1d996dcccb33100660e3531883d247b3

SHA1
c27c7350c58915321865c46474c3585202a478df

SHA256
32b0b89bfa0e8236f1db4d93945b62b1fe3da288e4eab1d19df66321cbfcd14f

SHA512
8d51f37b9bcf9d4661e5377377d149fd7d0c06baac3a39114e998721ac5a06b8ae21a7a4514a42432833856577209356eddd7f4e80ee05b98cae317affae4b9d

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\L6Q1ARHV.cookie
Filesize
592B

MD5
d12b7cf924a333a84ce1975b680774c5

SHA1
c26f96c665e7cfd519725b9b37f3906aab4aa1bf

SHA256
bfb927dbeb9c634ca7388eb9f5d268c1bd2cdaae66931170115643b6747d70eb

SHA512
675283c7aef7b56b972faa469a64de3cf480993b53e2f9cefd754c910863b2b8c965b9d671b4c56afffbf59cd25edcf2116e7ee8f50df62e85f07eb81a50620b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\NRTVVU6E.cookie
Filesize
172B

MD5
c13e6736eaf374d7e3be7323760b39f6

SHA1
e05a2d7f794f2d71356d335d989f71b7fc42be66

SHA256
80f77f5afffb031373a41a8bc67772ec079391f5f71e78ebcedb85b6f131faa3

SHA512
cc7bb75be920c0bcf4795d35cbaf991f279dc10449d41baeb94d4bfd3536f06e49e3e0eaabbebe8625361246a3942a2b49e8d0c323cff34bd18196e7cfe20443

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\SN38HYJR.cookie
Filesize
340B

MD5
584c70b857f0ce316554ea0a0fce424e

SHA1
db6658c9f878f951affe6126a38669a8287221ee

SHA256
45a1e61982245325c2be582ceb6273337fc0d5df1f6c4db853624ac80d682a59

SHA512
bebd2ac9a91d46c90c1876eaf2800edc6262f6a188615c82b3e77316cf13952f3cc45d41258e1ff0caccb778a429c4e272012deb30204e0e78dd3055bd15d7fc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\VBWAZDYB.cookie
Filesize
508B

MD5
1c9430eb375d9d345bc45ad186e09333

SHA1
57dc8211425842ba0a84bbb31414272c049de3e7

SHA256
2b4a45e18f3bc021d8799f7ac4776a932b419b1b19798ea410379da23a8778b8

SHA512
d6889c286e1415aa035dd4fc068a66e6754725aa8f5f014472cf50c8372a33e5b72e9421d426741a6c941f49dc4ec0d30ffc48656fce00177057d5ed2f02ccd0

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Filesize
717B

MD5
ec8ff3b1ded0246437b1472c69dd1811

SHA1
d813e874c2524e3a7da6c466c67854ad16800326

SHA256
e634c2d1ed20e0638c95597adf4c9d392ebab932d3353f18af1e4421f4bb9cab

SHA512
e967b804cbf2d6da30a532cbc62557d09bd236807790040c6bee5584a482dc09d724fc1d9ac0de6aa5b4e8b1fff72c8ab3206222cc2c95a91035754ac1257552

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Filesize
4KB

MD5
f7dcb24540769805e5bb30d193944dce

SHA1
e26c583c562293356794937d9e2e6155d15449ee

SHA256
6b88c6ac55bbd6fea0ebe5a760d1ad2cfce251c59d0151a1400701cb927e36ea

SHA512
cb5ad678b0ef642bf492f32079fe77e8be20c02de267f04b545df346b25f3e4eb98bb568c4c2c483bb88f7d1826863cb515b570d620766e52476c8ee2931ea94

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Filesize
4KB

MD5
f7dcb24540769805e5bb30d193944dce

SHA1
e26c583c562293356794937d9e2e6155d15449ee

SHA256
6b88c6ac55bbd6fea0ebe5a760d1ad2cfce251c59d0151a1400701cb927e36ea

SHA512
cb5ad678b0ef642bf492f32079fe77e8be20c02de267f04b545df346b25f3e4eb98bb568c4c2c483bb88f7d1826863cb515b570d620766e52476c8ee2931ea94

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Filesize
192B

MD5
5b840251c246c5ff28ff7dac34014e75

SHA1
0674d626ff716e2f9c8137135a9d65d2d84f79ba

SHA256
16a4fb9f8a68f0c4a9b28459b0af37aab4e441f118ef141ae1a8f1f1acd5b879

SHA512
bf6115316d244fdfaa7081b19e918a4c69ccad03b041c5790a24a272cd6175444d4d8f25e334a6ffa1dfaf0f2c6f2553bcac7b84fb8bc625c68cc9259c0da741

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Filesize
192B

MD5
5b840251c246c5ff28ff7dac34014e75

SHA1
0674d626ff716e2f9c8137135a9d65d2d84f79ba

SHA256
16a4fb9f8a68f0c4a9b28459b0af37aab4e441f118ef141ae1a8f1f1acd5b879

SHA512
bf6115316d244fdfaa7081b19e918a4c69ccad03b041c5790a24a272cd6175444d4d8f25e334a6ffa1dfaf0f2c6f2553bcac7b84fb8bc625c68cc9259c0da741

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Filesize
192B

MD5
05b0b67b0b2f2008fc15b990fb00bb7c

SHA1
696b8afe133dc15f67b929305a61b8038974e3ea

SHA256
2a9c252ee76d49083dd573377ce66b9efa94deeb9622d415185a83e56f8a538f

SHA512
e3294979dd2c97b68f8aee0affe76f2675e9081149f89271c3ea478b9d542f0fb6b98942a8cc4b9bb34189304fb688258c25fb9e406f2aa3a80176c7c9c66457

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Filesize
192B

MD5
69178d321ef6ab635bd44674a3329f56

SHA1
73dfba97881525684e1029492109bbc9b000a23b

SHA256
4941edd17a035dd5006b9c7e2a1aec7db895ebbd69ea2c363aa71418a4e84bdc

SHA512
001ee293c8c4a292e931e7f56c27a2577fc0b0a1972932a2737c32909868f08134fdba541e5e6cbc40f891c34e5d4610f7a482015aaa0c451269e2767b1d4ce1

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Filesize
192B

MD5
1dc727d0642b514946afa1e79ec497c2

SHA1
cd2cf08beac1d79259a0ede2b2436199b32086c1

SHA256
1ecf4ea92dedeaa92f804ed16ceadefd71610faf53b322588b0151aa1f044613

SHA512
6000ca508d878ae5a47d7e33830f5a1db8b15fe1c5410d552412460ceb74a24dfdd969239088aea2a69690ed11a4ebbf26bea9510b5174f592da62c2a7afe197

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Filesize
192B

MD5
93b14922e76f138185016692ed16168f

SHA1
f118e7b927ee1b21d0c47ecfae7e0118bb461659

SHA256
ec17f7c859b93a8b62fbe056a904775080981ca089229177bd7109320821f7e0

SHA512
a83ec4a8c236a49e55766d7d7532103342fcf8d51f86c12a1f813c9a4850859994bc10e9223ccf187fa37298b88e63936b6dc9ad2910fee809fe1b96fb19c235

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Filesize
340B

MD5
30e26355060cf28dc3314781c0253a20

SHA1
60863adaafdf1d2ecfc6211ff9893eb85f7a1743

SHA256
d3edade3cc8c6a12e92d61bc3197c5cad1c9aef414c9977ab248939c4ea84126

SHA512
d623318fef0dfdbd22944a48bcce0625d9f35616cd3c9f30d8f5c88be11530803d647b404711e421ad1c09045479f2f29348084f73d7631ac136ed0fd10ed2e1

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Filesize
340B

MD5
1cad551b81b113a970afdc12f4239415

SHA1
c6bcaa613f10f5e2a204814189ba6fb427bb2e20

SHA256
716b669a2011eddf7c763f35d8a1765b81dfb6920a749e78119302c3ee3d26e9

SHA512
b8dbb01e5048f09967bf312e226e590a15dfeae63b7bcbf1cb325cae0d5fa7db8149a16fa0b6ba53df9f02df9aa2e2788b18bd92d5c27fabe4f778ae5fddc35e

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\Windows\3720402701\2219095117.pri
Filesize
207KB

MD5
e2b88765ee31470114e866d939a8f2c6

SHA1
e0a53b8511186ff308a0507b6304fb16cabd4e1f

SHA256
523e419d2fa2e780239812d36caa37e92f8c3e6a5cd9f18f0d807c593effa45e

SHA512
462e8e6b4e63fc6781b6a9935b332a1dc77bfb88e1de49134f86fd46bd1598d2e842902dd9415a328e325bd7cdee766bd9473f2695acdfa769ffe7ba9ae1953d

Download Submit
memory/4020-149-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-136-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-154-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-155-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-156-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-157-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-158-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-159-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-160-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-161-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-162-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-163-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-164-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-165-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-166-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-167-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-168-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-169-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-172-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-175-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-174-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-176-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-177-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-173-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-171-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-170-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-152-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-115-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-151-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-116-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-150-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-117-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-114-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-148-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-118-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-119-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-147-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-146-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-120-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-145-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-144-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-143-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-121-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-122-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-123-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-142-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-141-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-124-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-140-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-139-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-138-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-153-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-137-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-135-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-134-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-128-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-133-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-132-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-131-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-130-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-129-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-127-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-126-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4020-125-0x0000000077BC0000-0x0000000077D4E000-memory.dmp

Filesize
1.6MB

Download
memory/4760-956-0x0000000000590000-0x00000000006DA000-memory.dmp

Filesize
1.3MB

Download
memory/4760-622-0x000000000074A000-0x000000000075B000-memory.dmp

Filesize
68KB

Download
memory/4760-1054-0x000000000074A000-0x000000000075B000-memory.dmp

Filesize
68KB

Download
memory/4760-302-0x0000000000000000-mapping.dmp

Download
memory/4760-957-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4760-954-0x000000000074A000-0x000000000075B000-memory.dmp

Filesize
68KB

Download
memory/4760-639-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4760-630-0x0000000000590000-0x00000000006DA000-memory.dmp

Filesize
1.3MB

Download
memory/4788-894-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4788-305-0x0000000000000000-mapping.dmp

Download
memory/4788-892-0x00000000022E0000-0x00000000022F2000-memory.dmp

Filesize
72KB

Download
memory/4816-1010-0x00000000075E0000-0x00000000075FE000-memory.dmp

Filesize
120KB

Download
memory/4816-834-0x00000000072A0000-0x00000000072B2000-memory.dmp

Filesize
72KB

Download
memory/4816-617-0x0000000000770000-0x0000000000790000-memory.dmp

Filesize
128KB

Download
memory/4816-309-0x0000000000000000-mapping.dmp

Download
memory/4816-853-0x0000000005700000-0x000000000573E000-memory.dmp

Filesize
248KB

Download
memory/4840-313-0x0000000000000000-mapping.dmp

Download
memory/4888-721-0x0000000001600000-0x0000000001606000-memory.dmp

Filesize
24KB

Download
memory/4888-966-0x0000000006C40000-0x000000000713E000-memory.dmp

Filesize
5.0MB

Download
memory/4888-640-0x0000000000BE0000-0x0000000000C24000-memory.dmp

Filesize
272KB

Download
memory/4888-323-0x0000000000000000-mapping.dmp

Download
memory/4888-1002-0x0000000006740000-0x00000000067D2000-memory.dmp

Filesize
584KB

Download
memory/4912-1018-0x0000000006C00000-0x000000000712C000-memory.dmp

Filesize
5.2MB

Download
memory/4912-327-0x0000000000000000-mapping.dmp

Download
memory/4912-650-0x0000000000200000-0x0000000000220000-memory.dmp

Filesize
128KB

Download
memory/4912-1016-0x0000000006500000-0x00000000066C2000-memory.dmp

Filesize
1.8MB

Download
memory/4912-838-0x0000000004B90000-0x0000000004C9A000-memory.dmp

Filesize
1.0MB

Download
memory/4912-830-0x0000000005090000-0x0000000005696000-memory.dmp

Filesize
6.0MB

Download
memory/4912-1001-0x0000000005920000-0x0000000005996000-memory.dmp

Filesize
472KB

Download
memory/4956-669-0x0000000000470000-0x0000000000490000-memory.dmp

Filesize
128KB

Download
memory/4956-963-0x0000000005020000-0x0000000005086000-memory.dmp

Filesize
408KB

Download
memory/4956-336-0x0000000000000000-mapping.dmp

Download
memory/4956-1015-0x0000000005F40000-0x0000000005F90000-memory.dmp

Filesize
320KB

Download
memory/4956-863-0x0000000004D30000-0x0000000004D7B000-memory.dmp

Filesize
300KB

Download
memory/4996-664-0x0000000000610000-0x0000000000630000-memory.dmp

Filesize
128KB

Download
memory/4996-344-0x0000000000000000-mapping.dmp

Download
memory/5040-353-0x0000000000000000-mapping.dmp

Download
memory/5096-364-0x0000000000000000-mapping.dmp

Download