Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
14-08-2022 03:36
Static task
static1
General
-
Target
8bc51a634781cf0d8e4e92b66b352598dadf226a41d4554e003dc26c736eacc2.exe
-
Size
1.1MB
-
MD5
8a56ca8ab6a4693b53d57b249c55e2f8
-
SHA1
f050b2ef88ac4aa88dc23ac161b0184c21498c89
-
SHA256
8bc51a634781cf0d8e4e92b66b352598dadf226a41d4554e003dc26c736eacc2
-
SHA512
22523b8241806a06c7789464b02f0fbc07736055d434a7aa64593797af53e526bcaf5aa2afe0ba3953f3c583fa3c1c926f0041a269ef210f56ccab31f98f4849
Malware Config
Extracted
redline
nam3
103.89.90.61:34589
-
auth_value
64b900120bbceaa6a9c60e9079492895
Extracted
redline
5
176.113.115.146:9582
-
auth_value
d38b30c1ccd6c1e5088d9e5bd9e51b0f
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 6 IoCs
Processes:
resource yara_rule C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe family_redline C:\Program Files (x86)\Company\NewProduct\safert44.exe family_redline C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe family_redline C:\Program Files (x86)\Company\NewProduct\safert44.exe family_redline behavioral1/memory/456-454-0x0000000000420000-0x0000000000440000-memory.dmp family_redline behavioral1/memory/1136-463-0x00000000000A0000-0x00000000000E4000-memory.dmp family_redline -
Downloads MZ/PE file
-
Executes dropped EXE 6 IoCs
Processes:
F0geI.exekukurzka9000.exenamdoitntn.exereal.exesafert44.exeWW1.exepid process 3476 F0geI.exe 3976 kukurzka9000.exe 456 namdoitntn.exe 688 real.exe 1136 safert44.exe 3820 WW1.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
8bc51a634781cf0d8e4e92b66b352598dadf226a41d4554e003dc26c736eacc2.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000\Control Panel\International\Geo\Nation 8bc51a634781cf0d8e4e92b66b352598dadf226a41d4554e003dc26c736eacc2.exe -
Loads dropped DLL 3 IoCs
Processes:
F0geI.exepid process 3476 F0geI.exe 3476 F0geI.exe 3476 F0geI.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in Program Files directory 6 IoCs
Processes:
8bc51a634781cf0d8e4e92b66b352598dadf226a41d4554e003dc26c736eacc2.exedescription ioc process File opened for modification C:\Program Files (x86)\Company\NewProduct\F0geI.exe 8bc51a634781cf0d8e4e92b66b352598dadf226a41d4554e003dc26c736eacc2.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe 8bc51a634781cf0d8e4e92b66b352598dadf226a41d4554e003dc26c736eacc2.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe 8bc51a634781cf0d8e4e92b66b352598dadf226a41d4554e003dc26c736eacc2.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\real.exe 8bc51a634781cf0d8e4e92b66b352598dadf226a41d4554e003dc26c736eacc2.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\safert44.exe 8bc51a634781cf0d8e4e92b66b352598dadf226a41d4554e003dc26c736eacc2.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\WW1.exe 8bc51a634781cf0d8e4e92b66b352598dadf226a41d4554e003dc26c736eacc2.exe -
Drops file in Windows directory 6 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exedescription ioc process File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdge.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdgeCP.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
real.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 real.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString real.exe -
Processes:
MicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe -
Modifies registry class 64 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CacheLimit = "1" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$Telligent MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CacheLimit = "256000" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url1 = "https://www.facebook.com/" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 0000000000000000 MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$http://www.typepad.com/ MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "256000" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Extensible Cache MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData\RulesFileNextUpdateDate = "366610322" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 4f7ac01f8fafd801 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\FlipAheadCompletedVersion = "1" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 189c8c198fafd801 MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Next Rating Prompt = d084523575bad801 MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CacheLimit = "256000" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\NextUpdateDate = "367213187" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheLimit = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\DatastoreSchemaVersion = "8" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 3de2c8338fafd801 MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 926d1b358fafd801 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\Certificates MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 215240198fafd801 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames\en-US = "en-US.1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\Certificates\83DA05A9886F7658B MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\AllComplete = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\MrtCache MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2600230786-2767877416-126655653-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
real.exesafert44.exenamdoitntn.exepid process 688 real.exe 688 real.exe 1136 safert44.exe 1136 safert44.exe 456 namdoitntn.exe 456 namdoitntn.exe -
Suspicious behavior: MapViewOfSection 4 IoCs
Processes:
MicrosoftEdgeCP.exepid process 4656 MicrosoftEdgeCP.exe 4656 MicrosoftEdgeCP.exe 4656 MicrosoftEdgeCP.exe 4656 MicrosoftEdgeCP.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exesafert44.exenamdoitntn.exeMicrosoftEdgeCP.exedescription pid process Token: SeDebugPrivilege 3668 MicrosoftEdge.exe Token: SeDebugPrivilege 3668 MicrosoftEdge.exe Token: SeDebugPrivilege 3668 MicrosoftEdge.exe Token: SeDebugPrivilege 3668 MicrosoftEdge.exe Token: SeDebugPrivilege 4112 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4112 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4112 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4112 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 1136 safert44.exe Token: SeDebugPrivilege 456 namdoitntn.exe Token: SeDebugPrivilege 4192 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4192 MicrosoftEdgeCP.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exepid process 3668 MicrosoftEdge.exe 4656 MicrosoftEdgeCP.exe 4656 MicrosoftEdgeCP.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
8bc51a634781cf0d8e4e92b66b352598dadf226a41d4554e003dc26c736eacc2.exeMicrosoftEdgeCP.exedescription pid process target process PID 2332 wrote to memory of 3476 2332 8bc51a634781cf0d8e4e92b66b352598dadf226a41d4554e003dc26c736eacc2.exe F0geI.exe PID 2332 wrote to memory of 3476 2332 8bc51a634781cf0d8e4e92b66b352598dadf226a41d4554e003dc26c736eacc2.exe F0geI.exe PID 2332 wrote to memory of 3476 2332 8bc51a634781cf0d8e4e92b66b352598dadf226a41d4554e003dc26c736eacc2.exe F0geI.exe PID 2332 wrote to memory of 3976 2332 8bc51a634781cf0d8e4e92b66b352598dadf226a41d4554e003dc26c736eacc2.exe kukurzka9000.exe PID 2332 wrote to memory of 3976 2332 8bc51a634781cf0d8e4e92b66b352598dadf226a41d4554e003dc26c736eacc2.exe kukurzka9000.exe PID 2332 wrote to memory of 3976 2332 8bc51a634781cf0d8e4e92b66b352598dadf226a41d4554e003dc26c736eacc2.exe kukurzka9000.exe PID 2332 wrote to memory of 456 2332 8bc51a634781cf0d8e4e92b66b352598dadf226a41d4554e003dc26c736eacc2.exe namdoitntn.exe PID 2332 wrote to memory of 456 2332 8bc51a634781cf0d8e4e92b66b352598dadf226a41d4554e003dc26c736eacc2.exe namdoitntn.exe PID 2332 wrote to memory of 456 2332 8bc51a634781cf0d8e4e92b66b352598dadf226a41d4554e003dc26c736eacc2.exe namdoitntn.exe PID 2332 wrote to memory of 688 2332 8bc51a634781cf0d8e4e92b66b352598dadf226a41d4554e003dc26c736eacc2.exe real.exe PID 2332 wrote to memory of 688 2332 8bc51a634781cf0d8e4e92b66b352598dadf226a41d4554e003dc26c736eacc2.exe real.exe PID 2332 wrote to memory of 688 2332 8bc51a634781cf0d8e4e92b66b352598dadf226a41d4554e003dc26c736eacc2.exe real.exe PID 2332 wrote to memory of 1136 2332 8bc51a634781cf0d8e4e92b66b352598dadf226a41d4554e003dc26c736eacc2.exe safert44.exe PID 2332 wrote to memory of 1136 2332 8bc51a634781cf0d8e4e92b66b352598dadf226a41d4554e003dc26c736eacc2.exe safert44.exe PID 2332 wrote to memory of 1136 2332 8bc51a634781cf0d8e4e92b66b352598dadf226a41d4554e003dc26c736eacc2.exe safert44.exe PID 2332 wrote to memory of 3820 2332 8bc51a634781cf0d8e4e92b66b352598dadf226a41d4554e003dc26c736eacc2.exe WW1.exe PID 2332 wrote to memory of 3820 2332 8bc51a634781cf0d8e4e92b66b352598dadf226a41d4554e003dc26c736eacc2.exe WW1.exe PID 2332 wrote to memory of 3820 2332 8bc51a634781cf0d8e4e92b66b352598dadf226a41d4554e003dc26c736eacc2.exe WW1.exe PID 4656 wrote to memory of 4780 4656 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4656 wrote to memory of 4780 4656 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4656 wrote to memory of 4780 4656 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4656 wrote to memory of 4780 4656 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4656 wrote to memory of 672 4656 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4656 wrote to memory of 672 4656 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4656 wrote to memory of 672 4656 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4656 wrote to memory of 672 4656 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8bc51a634781cf0d8e4e92b66b352598dadf226a41d4554e003dc26c736eacc2.exe"C:\Users\Admin\AppData\Local\Temp\8bc51a634781cf0d8e4e92b66b352598dadf226a41d4554e003dc26c736eacc2.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Program Files (x86)\Company\NewProduct\F0geI.exe"C:\Program Files (x86)\Company\NewProduct\F0geI.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3476 -
C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe"C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe"2⤵
- Executes dropped EXE
PID:3976 -
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe"C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:456 -
C:\Program Files (x86)\Company\NewProduct\real.exe"C:\Program Files (x86)\Company\NewProduct\real.exe"2⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:688 -
C:\Program Files (x86)\Company\NewProduct\safert44.exe"C:\Program Files (x86)\Company\NewProduct\safert44.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1136 -
C:\Program Files (x86)\Company\NewProduct\WW1.exe"C:\Program Files (x86)\Company\NewProduct\WW1.exe"2⤵
- Executes dropped EXE
PID:3820
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3668
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:1332
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4656
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4112
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4780
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
PID:1040
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
PID:672
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:4976
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:4028
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4192
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Company\NewProduct\F0geI.exeFilesize
339KB
MD5501e0f6fa90340e3d7ff26f276cd582e
SHA11bce4a6153f71719e786f8f612fbfcd23d3e130a
SHA256f07d918c6571f11abf9ab7268ac6e2ecbcd931c3d9d878895c777d15052aae2b
SHA512dee3aabfca7912f15b628253222cfe8d8e13cd64f0438e8d705b68b0a14b4c9523b7a207583be7b424e444d6b05f237484a0c38bf2e075d347ef937d409a3a69
-
C:\Program Files (x86)\Company\NewProduct\F0geI.exeFilesize
339KB
MD5501e0f6fa90340e3d7ff26f276cd582e
SHA11bce4a6153f71719e786f8f612fbfcd23d3e130a
SHA256f07d918c6571f11abf9ab7268ac6e2ecbcd931c3d9d878895c777d15052aae2b
SHA512dee3aabfca7912f15b628253222cfe8d8e13cd64f0438e8d705b68b0a14b4c9523b7a207583be7b424e444d6b05f237484a0c38bf2e075d347ef937d409a3a69
-
C:\Program Files (x86)\Company\NewProduct\WW1.exeFilesize
281KB
MD51885946b127569cff6c03bea7175c3a0
SHA19bde463fc59f36f7fca6ab4d5f31b52cf979fc22
SHA2566e445a4ed5beff50cf4935e54d2c48e25bade941378fe8fe3f0914413e90e09b
SHA512e954c609b998b01b85614d3bda84a410d48db0559d68a69d7b07cfbed9cf4311f7c0b60fcc060c874dd757e774112283ec7f22c32a6ecf268a775becfea72a0b
-
C:\Program Files (x86)\Company\NewProduct\WW1.exeFilesize
281KB
MD51885946b127569cff6c03bea7175c3a0
SHA19bde463fc59f36f7fca6ab4d5f31b52cf979fc22
SHA2566e445a4ed5beff50cf4935e54d2c48e25bade941378fe8fe3f0914413e90e09b
SHA512e954c609b998b01b85614d3bda84a410d48db0559d68a69d7b07cfbed9cf4311f7c0b60fcc060c874dd757e774112283ec7f22c32a6ecf268a775becfea72a0b
-
C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exeFilesize
1.4MB
MD5ec59f38fa35c0cf3babd976f5f23c74e
SHA12f7600ac9df0869fae48d99afe9569d83efafc8b
SHA2566d0d294e321014a3129d3533ce143f08b0a3639cc50ddaf236396b82a595925e
SHA512d4d2c4078dd40bc57d421750ac26f5467f082f6b4fae422d574ca406b928b6bb1e4f7cbb80a80b11f3908134028c6b7bb3b67c17e02d1899a6cda6e0312c3574
-
C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exeFilesize
1.4MB
MD5ec59f38fa35c0cf3babd976f5f23c74e
SHA12f7600ac9df0869fae48d99afe9569d83efafc8b
SHA2566d0d294e321014a3129d3533ce143f08b0a3639cc50ddaf236396b82a595925e
SHA512d4d2c4078dd40bc57d421750ac26f5467f082f6b4fae422d574ca406b928b6bb1e4f7cbb80a80b11f3908134028c6b7bb3b67c17e02d1899a6cda6e0312c3574
-
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exeFilesize
107KB
MD5bbd8ea73b7626e0ca5b91d355df39b7f
SHA166e298653beb7f652eb44922010910ced6242879
SHA2561aa3fdc24e789b01a39944b85c99e4ac08864d2eae7530164cea2821acbf184e
SHA512625cc9c108b4660030be1282493700e5f0ccfb973f466f61254ed1e1a96f5f042cdeaa94607825a2f694647468e2f525a6451542fe3aac785ebac1ccfe39864f
-
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exeFilesize
107KB
MD5bbd8ea73b7626e0ca5b91d355df39b7f
SHA166e298653beb7f652eb44922010910ced6242879
SHA2561aa3fdc24e789b01a39944b85c99e4ac08864d2eae7530164cea2821acbf184e
SHA512625cc9c108b4660030be1282493700e5f0ccfb973f466f61254ed1e1a96f5f042cdeaa94607825a2f694647468e2f525a6451542fe3aac785ebac1ccfe39864f
-
C:\Program Files (x86)\Company\NewProduct\real.exeFilesize
282KB
MD5474861050e6a7b65bc4521096cb05454
SHA14e1aabe27598171a89c219aab860b325a4358b22
SHA256ccd962957659555af7c607deb20a4ec34a1578af037d5310ffd07bd092f0ebc7
SHA51242afff00dd616fc73d1c338184149ddb66376e808cd2da39a94357c8d296a245ab0f1e474aac1789d613efef3c1867e0c3a2e41c07ac21bcc07e00ea08309a79
-
C:\Program Files (x86)\Company\NewProduct\real.exeFilesize
282KB
MD5474861050e6a7b65bc4521096cb05454
SHA14e1aabe27598171a89c219aab860b325a4358b22
SHA256ccd962957659555af7c607deb20a4ec34a1578af037d5310ffd07bd092f0ebc7
SHA51242afff00dd616fc73d1c338184149ddb66376e808cd2da39a94357c8d296a245ab0f1e474aac1789d613efef3c1867e0c3a2e41c07ac21bcc07e00ea08309a79
-
C:\Program Files (x86)\Company\NewProduct\safert44.exeFilesize
246KB
MD5414ffd7094c0f50662ffa508ca43b7d0
SHA16ec67bd53da2ff3d5538a3afcc6797af1e5a53fb
SHA256d3fb9c24b34c113992c5c658f6a11f9620da2e49d12d1acabe871e1bea7846ee
SHA512c6527077b4822c062e32c39be06e285916b501a358991d120a469f5da1e13d282685ca7ca3fa938292d5beef073fbea42ff9ba96fa5c395f057f7c964608a399
-
C:\Program Files (x86)\Company\NewProduct\safert44.exeFilesize
246KB
MD5414ffd7094c0f50662ffa508ca43b7d0
SHA16ec67bd53da2ff3d5538a3afcc6797af1e5a53fb
SHA256d3fb9c24b34c113992c5c658f6a11f9620da2e49d12d1acabe871e1bea7846ee
SHA512c6527077b4822c062e32c39be06e285916b501a358991d120a469f5da1e13d282685ca7ca3fa938292d5beef073fbea42ff9ba96fa5c395f057f7c964608a399
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\4SWOVH2J.cookieFilesize
170B
MD5bf1f3ddda4f25224ca4c9c79daa42c9c
SHA1cca34c7da510b93ea82d50f5d54cf01be09c1334
SHA25699304ed6a8827262276dbcecaedae27a04d6804af3607ccf1dd64683cce23f40
SHA5120631b43d1592a68fdf0d20b2623ed2bb0861926de1b71da2429690913584862c04f4df6b78f7cfe1456c13612e37e7eba0ec53c7cd6db3465e7ef7531e0899e7
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\98O9QJ0Y.cookieFilesize
336B
MD5dcf06cd3d4697cd4586b501a0d77a4b9
SHA1e539c477d1e20e9a5a3304e684f163c663e7be9c
SHA256017ce029d5a68d83d7eaa623c11d481afd039487f29e5f8935e1955be5335945
SHA512a76a930e62583db6c630ce2513d780889be7e53e19e929b0222aa8bf2fc1455ac2380a566dd9ce8bdc0a5a69b71f1e27e38ec53673eddfe096b5cacfadce8dc2
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\EG5D7TB0.cookieFilesize
253B
MD50d6cda97ac50bd91f75e01d586da72b6
SHA1eb4bb9a3aae56a5ab20a3a0e28aa4491ffe57c8c
SHA2568723de5d55f22be6ffc90277d43fd513cd91397ec3fc17166d7f8a294d4adcba
SHA5129a47209831306cbeb2281dde0168d277149feaae08622a815018f4c0e4416a9f0e21d0289655a81ec497f4805c606dcee0a73806f59300501951037a7bd2f430
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751Filesize
717B
MD5ec8ff3b1ded0246437b1472c69dd1811
SHA1d813e874c2524e3a7da6c466c67854ad16800326
SHA256e634c2d1ed20e0638c95597adf4c9d392ebab932d3353f18af1e4421f4bb9cab
SHA512e967b804cbf2d6da30a532cbc62557d09bd236807790040c6bee5584a482dc09d724fc1d9ac0de6aa5b4e8b1fff72c8ab3206222cc2c95a91035754ac1257552
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157Filesize
4KB
MD5f7dcb24540769805e5bb30d193944dce
SHA1e26c583c562293356794937d9e2e6155d15449ee
SHA2566b88c6ac55bbd6fea0ebe5a760d1ad2cfce251c59d0151a1400701cb927e36ea
SHA512cb5ad678b0ef642bf492f32079fe77e8be20c02de267f04b545df346b25f3e4eb98bb568c4c2c483bb88f7d1826863cb515b570d620766e52476c8ee2931ea94
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157Filesize
4KB
MD5f7dcb24540769805e5bb30d193944dce
SHA1e26c583c562293356794937d9e2e6155d15449ee
SHA2566b88c6ac55bbd6fea0ebe5a760d1ad2cfce251c59d0151a1400701cb927e36ea
SHA512cb5ad678b0ef642bf492f32079fe77e8be20c02de267f04b545df346b25f3e4eb98bb568c4c2c483bb88f7d1826863cb515b570d620766e52476c8ee2931ea94
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157Filesize
4KB
MD5f7dcb24540769805e5bb30d193944dce
SHA1e26c583c562293356794937d9e2e6155d15449ee
SHA2566b88c6ac55bbd6fea0ebe5a760d1ad2cfce251c59d0151a1400701cb927e36ea
SHA512cb5ad678b0ef642bf492f32079fe77e8be20c02de267f04b545df346b25f3e4eb98bb568c4c2c483bb88f7d1826863cb515b570d620766e52476c8ee2931ea94
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157Filesize
4KB
MD5f7dcb24540769805e5bb30d193944dce
SHA1e26c583c562293356794937d9e2e6155d15449ee
SHA2566b88c6ac55bbd6fea0ebe5a760d1ad2cfce251c59d0151a1400701cb927e36ea
SHA512cb5ad678b0ef642bf492f32079fe77e8be20c02de267f04b545df346b25f3e4eb98bb568c4c2c483bb88f7d1826863cb515b570d620766e52476c8ee2931ea94
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751Filesize
192B
MD57be5fd3d87dfd297078ec1ce8102c5f0
SHA1d232badf820013148008c334fda5e843b12ebf6a
SHA256017aa1e4d8d9bec252d1529d4d7781a2c5d11bda542022a7f491dbdf6ee58c74
SHA51204710b63e51fe1bc53488553c0cbb9a2910f31b05be4616ebc9f104ed4042ab283560a6f679f8cfb6f382cc638acad04a89692e0a38ec70bf4929fcfb633530b
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157Filesize
340B
MD51440b53cc344cc7cd66aeb200b5b4c2e
SHA1c25a8dbead100b85807976a7658ffe282ea23655
SHA256233920765bcc03026eae0411d04941b10a1ead0623a7807067a93bad7cebfcef
SHA51256f00f43c305e8a7e7ee9b42b10b6f18b9302fccec87e902b4353c706ace320adf02b12e841646be34a6a25d8a7bf9455bb86b9be5fd97b5c7f03705565ea1af
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157Filesize
340B
MD5d01f9f5d570ed79acae0abc94096a273
SHA17351f67454e87be1dc8b9b881dd466bfa109084e
SHA2566f79ea3f369d962940dc3749205d0b762b1a5346c18a947488a2e9d2eac353c6
SHA512efa5a8a4d3008b89185da7ef97f4053a5a970300944138b0d68e5485c51cb478601e1e4b74b6a4330edbf7c8356747021e20687bcbe01d0c9968e53cd93dc718
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157Filesize
340B
MD5d01f9f5d570ed79acae0abc94096a273
SHA17351f67454e87be1dc8b9b881dd466bfa109084e
SHA2566f79ea3f369d962940dc3749205d0b762b1a5346c18a947488a2e9d2eac353c6
SHA512efa5a8a4d3008b89185da7ef97f4053a5a970300944138b0d68e5485c51cb478601e1e4b74b6a4330edbf7c8356747021e20687bcbe01d0c9968e53cd93dc718
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157Filesize
340B
MD5d01f9f5d570ed79acae0abc94096a273
SHA17351f67454e87be1dc8b9b881dd466bfa109084e
SHA2566f79ea3f369d962940dc3749205d0b762b1a5346c18a947488a2e9d2eac353c6
SHA512efa5a8a4d3008b89185da7ef97f4053a5a970300944138b0d68e5485c51cb478601e1e4b74b6a4330edbf7c8356747021e20687bcbe01d0c9968e53cd93dc718
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\Windows\3720402701\2219095117.priFilesize
207KB
MD5e2b88765ee31470114e866d939a8f2c6
SHA1e0a53b8511186ff308a0507b6304fb16cabd4e1f
SHA256523e419d2fa2e780239812d36caa37e92f8c3e6a5cd9f18f0d807c593effa45e
SHA512462e8e6b4e63fc6781b6a9935b332a1dc77bfb88e1de49134f86fd46bd1598d2e842902dd9415a328e325bd7cdee766bd9473f2695acdfa769ffe7ba9ae1953d
-
\Users\Admin\AppData\LocalLow\mozglue.dllFilesize
612KB
MD5f07d9977430e762b563eaadc2b94bbfa
SHA1da0a05b2b8d269fb73558dfcf0ed5c167f6d3877
SHA2564191faf7e5eb105a0f4c5c6ed3e9e9c71014e8aa39bbee313bc92d1411e9e862
SHA5126afd512e4099643bba3fc7700dd72744156b78b7bda10263ba1f8571d1e282133a433215a9222a7799f9824f244a2bc80c2816a62de1497017a4b26d562b7eaf
-
\Users\Admin\AppData\LocalLow\nss3.dllFilesize
1.9MB
MD5f67d08e8c02574cbc2f1122c53bfb976
SHA16522992957e7e4d074947cad63189f308a80fcf2
SHA256c65b7afb05ee2b2687e6280594019068c3d3829182dfe8604ce4adf2116cc46e
SHA5122e9d0a211d2b085514f181852fae6e7ca6aed4d29f396348bedb59c556e39621810a9a74671566a49e126ec73a60d0f781fa9085eb407df1eefd942c18853be5
-
\Users\Admin\AppData\LocalLow\sqlite3.dllFilesize
1.0MB
MD5dbf4f8dcefb8056dc6bae4b67ff810ce
SHA1bbac1dd8a07c6069415c04b62747d794736d0689
SHA25647b64311719000fa8c432165a0fdcdfed735d5b54977b052de915b1cbbbf9d68
SHA512b572ca2f2e4a5cc93e4fcc7a18c0ae6df888aa4c55bc7da591e316927a4b5cfcbdda6e60018950be891ff3b26f470cc5cce34d217c2d35074322ab84c32a25d1
-
memory/456-254-0x0000000000000000-mapping.dmp
-
memory/456-565-0x0000000005410000-0x000000000551A000-memory.dmpFilesize
1.0MB
-
memory/456-562-0x00000000052E0000-0x00000000052F2000-memory.dmpFilesize
72KB
-
memory/456-557-0x0000000005790000-0x0000000005D96000-memory.dmpFilesize
6.0MB
-
memory/456-589-0x0000000005720000-0x000000000576B000-memory.dmpFilesize
300KB
-
memory/456-579-0x0000000005600000-0x000000000563E000-memory.dmpFilesize
248KB
-
memory/456-454-0x0000000000420000-0x0000000000440000-memory.dmpFilesize
128KB
-
memory/688-258-0x0000000000000000-mapping.dmp
-
memory/1136-503-0x00000000009F0000-0x00000000009F6000-memory.dmpFilesize
24KB
-
memory/1136-661-0x0000000004EE0000-0x0000000004F72000-memory.dmpFilesize
584KB
-
memory/1136-264-0x0000000000000000-mapping.dmp
-
memory/1136-662-0x0000000006110000-0x000000000660E000-memory.dmpFilesize
5.0MB
-
memory/1136-667-0x00000000050A0000-0x00000000050BE000-memory.dmpFilesize
120KB
-
memory/1136-670-0x0000000005A10000-0x0000000005A76000-memory.dmpFilesize
408KB
-
memory/1136-684-0x0000000006610000-0x00000000067D2000-memory.dmpFilesize
1.8MB
-
memory/1136-660-0x0000000004DC0000-0x0000000004E36000-memory.dmpFilesize
472KB
-
memory/1136-463-0x00000000000A0000-0x00000000000E4000-memory.dmpFilesize
272KB
-
memory/1136-685-0x0000000008390000-0x00000000088BC000-memory.dmpFilesize
5.2MB
-
memory/1136-703-0x0000000006060000-0x00000000060B0000-memory.dmpFilesize
320KB
-
memory/2332-141-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-149-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-170-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-171-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-172-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-173-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-174-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-175-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-176-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-177-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-178-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-179-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-180-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-181-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-182-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-183-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-121-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-122-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-168-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-167-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-166-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-165-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-157-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-163-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-123-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-164-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-162-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-161-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-160-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-159-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-158-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-155-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-156-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-154-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-153-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-142-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-124-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-125-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-126-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-120-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-169-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-152-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-151-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-150-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-148-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-147-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-127-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-128-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-146-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-145-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-144-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-143-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-140-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-139-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-138-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-137-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-136-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-135-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-134-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-133-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-132-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-131-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-130-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/2332-129-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/3476-701-0x000000000071A000-0x000000000072B000-memory.dmpFilesize
68KB
-
memory/3476-658-0x0000000000470000-0x00000000005BA000-memory.dmpFilesize
1.3MB
-
memory/3476-659-0x0000000000400000-0x000000000046E000-memory.dmpFilesize
440KB
-
memory/3476-657-0x000000000071A000-0x000000000072B000-memory.dmpFilesize
68KB
-
memory/3476-246-0x0000000000000000-mapping.dmp
-
memory/3476-483-0x0000000000400000-0x000000000046E000-memory.dmpFilesize
440KB
-
memory/3476-478-0x0000000000470000-0x00000000005BA000-memory.dmpFilesize
1.3MB
-
memory/3476-471-0x000000000071A000-0x000000000072B000-memory.dmpFilesize
68KB
-
memory/3476-702-0x0000000000400000-0x000000000046E000-memory.dmpFilesize
440KB
-
memory/3820-271-0x0000000000000000-mapping.dmp
-
memory/3976-609-0x0000000000400000-0x000000000056A000-memory.dmpFilesize
1.4MB
-
memory/3976-250-0x0000000000000000-mapping.dmp
-
memory/3976-607-0x0000000002320000-0x0000000002332000-memory.dmpFilesize
72KB