redline | 13f8728b95a9ca527c725c440726814ffbc88eeaf9323e50958fa3a8df969372

Analysis

max time kernel
53s
max time network
142s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
19-08-2022 04:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13f8728b95a9ca527c725c440726814ffbc88eeaf9323e50958fa3a8df969372.exe
Size

1.1MB
MD5

80811e204cb2d3a4ae4ffef363fd3104
SHA1

156e0133c120cf78e542638a5a22140032fd13ae
SHA256

13f8728b95a9ca527c725c440726814ffbc88eeaf9323e50958fa3a8df969372
SHA512

c309c222d7e86254d8d8c8f4885d0c0232cebbbca0cf9039d3bb99dc73512d31bfc8d911bc579f19a53a10f9eb26d9b5fdd901e4de7da81e25896cefe992afe4

Score

10^/10

redline 5 nam3 discovery infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

nam3

103.89.90.61:34589

Attributes

auth_value
64b900120bbceaa6a9c60e9079492895

Extracted

Family

redline

Botnet

176.113.115.146:9582

Attributes

auth_value
d38b30c1ccd6c1e5088d9e5bd9e51b0f

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 6 IoCs

Processes:

resource	yara_rule
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\safert44.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\safert44.exe	family_redline
behavioral1/memory/4348-422-0x0000000000D40000-0x0000000000D60000-memory.dmp	family_redline
behavioral1/memory/648-423-0x00000000001D0000-0x0000000000214000-memory.dmp	family_redline

Executes dropped EXE 8 IoCs

Processes:

F0geI.exekukurzka9000.exenamdoitntn.exereal.exesafert44.execaptain09876.exeEU1.exeSETUP_~1.EXE

pid process

4520 F0geI.exe
3968 kukurzka9000.exe
4348 namdoitntn.exe
1700 real.exe
648 safert44.exe
916 captain09876.exe
4784 EU1.exe
1372 SETUP_~1.EXE

pid	process
4520	F0geI.exe
3968	kukurzka9000.exe
4348	namdoitntn.exe
1700	real.exe
648	safert44.exe
916	captain09876.exe
4784	EU1.exe
1372	SETUP_~1.EXE

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

13f8728b95a9ca527c725c440726814ffbc88eeaf9323e50958fa3a8df969372.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Control Panel\International\Geo\Nation	13f8728b95a9ca527c725c440726814ffbc88eeaf9323e50958fa3a8df969372.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

captain09876.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	captain09876.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	captain09876.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 7 IoCs

Processes:

13f8728b95a9ca527c725c440726814ffbc88eeaf9323e50958fa3a8df969372.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Company\NewProduct\safert44.exe	13f8728b95a9ca527c725c440726814ffbc88eeaf9323e50958fa3a8df969372.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\captain09876.exe	13f8728b95a9ca527c725c440726814ffbc88eeaf9323e50958fa3a8df969372.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\EU1.exe	13f8728b95a9ca527c725c440726814ffbc88eeaf9323e50958fa3a8df969372.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\F0geI.exe	13f8728b95a9ca527c725c440726814ffbc88eeaf9323e50958fa3a8df969372.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe	13f8728b95a9ca527c725c440726814ffbc88eeaf9323e50958fa3a8df969372.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	13f8728b95a9ca527c725c440726814ffbc88eeaf9323e50958fa3a8df969372.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\real.exe	13f8728b95a9ca527c725c440726814ffbc88eeaf9323e50958fa3a8df969372.exe

Drops file in Windows directory 6 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

MicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\DatastoreSchemaVersion = "8"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B7216 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\SmartScreenCompletedVersi = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\AllComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\MigrationTime = 51e0d6d06eaed801	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\InternetRegistry	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{9CAEF07B-E6F0-45B3-9932-4A399F1C6633} = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url2 = "https://login.aliexpress.com/"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DontShowMeThisDialogAgain	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 6e2d6ee596b3d801	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\ManagerHistoryComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites\Order = 0c0000000a000000000000000c0000000100000000000000	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\FontSize = "3"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 01000000ec79734afee0f23adeb70e76710f1dae74743cdc7201afd76b26d5f98153192435f898482586e5b040688d77b24f5f32689b09bd5dfaa82241e5	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\UUID = "{0E1B1F9E-0AD4-496C-B14D-DE15EBCA8243}"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url3 = "https://signin.ebay.com/ws/ebayisapi.dll"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\AllComplete = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 01000000c8bcc81b6a884935ba71c7813dd27cc9085c3f429ebaff21e7aa96b715b679df910049d811dd21dd9213b3fe440cbecf3b4e4e28b30305331d6fcb2e1888b99b2c296fd6b982dc7f9cc27b9b49786e38e5cf269f9a86242bc534	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\FirstRecoveryTime = 51e0d6d06eaed801	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

MicrosoftEdgeCP.exe

pid process

4444 MicrosoftEdgeCP.exe
4444 MicrosoftEdgeCP.exe

pid	process
4444	MicrosoftEdgeCP.exe
4444	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeSETUP_~1.EXE

description	pid	process
Token: SeDebugPrivilege	3404	MicrosoftEdge.exe
Token: SeDebugPrivilege	3404	MicrosoftEdge.exe
Token: SeDebugPrivilege	3404	MicrosoftEdge.exe
Token: SeDebugPrivilege	3404	MicrosoftEdge.exe
Token: SeDebugPrivilege	4920	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4920	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4920	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4920	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1372	SETUP_~1.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exe

pid process

3404 MicrosoftEdge.exe
4444 MicrosoftEdgeCP.exe
4444 MicrosoftEdgeCP.exe

pid	process
3404	MicrosoftEdge.exe
4444	MicrosoftEdgeCP.exe
4444	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

13f8728b95a9ca527c725c440726814ffbc88eeaf9323e50958fa3a8df969372.execaptain09876.exeMicrosoftEdgeCP.exe

description	pid	process	target process
PID 2068 wrote to memory of 4520	2068	13f8728b95a9ca527c725c440726814ffbc88eeaf9323e50958fa3a8df969372.exe	F0geI.exe
PID 2068 wrote to memory of 4520	2068	13f8728b95a9ca527c725c440726814ffbc88eeaf9323e50958fa3a8df969372.exe	F0geI.exe
PID 2068 wrote to memory of 4520	2068	13f8728b95a9ca527c725c440726814ffbc88eeaf9323e50958fa3a8df969372.exe	F0geI.exe
PID 2068 wrote to memory of 3968	2068	13f8728b95a9ca527c725c440726814ffbc88eeaf9323e50958fa3a8df969372.exe	kukurzka9000.exe
PID 2068 wrote to memory of 3968	2068	13f8728b95a9ca527c725c440726814ffbc88eeaf9323e50958fa3a8df969372.exe	kukurzka9000.exe
PID 2068 wrote to memory of 3968	2068	13f8728b95a9ca527c725c440726814ffbc88eeaf9323e50958fa3a8df969372.exe	kukurzka9000.exe
PID 2068 wrote to memory of 4348	2068	13f8728b95a9ca527c725c440726814ffbc88eeaf9323e50958fa3a8df969372.exe	namdoitntn.exe
PID 2068 wrote to memory of 4348	2068	13f8728b95a9ca527c725c440726814ffbc88eeaf9323e50958fa3a8df969372.exe	namdoitntn.exe
PID 2068 wrote to memory of 4348	2068	13f8728b95a9ca527c725c440726814ffbc88eeaf9323e50958fa3a8df969372.exe	namdoitntn.exe
PID 2068 wrote to memory of 1700	2068	13f8728b95a9ca527c725c440726814ffbc88eeaf9323e50958fa3a8df969372.exe	real.exe
PID 2068 wrote to memory of 1700	2068	13f8728b95a9ca527c725c440726814ffbc88eeaf9323e50958fa3a8df969372.exe	real.exe
PID 2068 wrote to memory of 1700	2068	13f8728b95a9ca527c725c440726814ffbc88eeaf9323e50958fa3a8df969372.exe	real.exe
PID 2068 wrote to memory of 648	2068	13f8728b95a9ca527c725c440726814ffbc88eeaf9323e50958fa3a8df969372.exe	safert44.exe
PID 2068 wrote to memory of 648	2068	13f8728b95a9ca527c725c440726814ffbc88eeaf9323e50958fa3a8df969372.exe	safert44.exe
PID 2068 wrote to memory of 648	2068	13f8728b95a9ca527c725c440726814ffbc88eeaf9323e50958fa3a8df969372.exe	safert44.exe
PID 2068 wrote to memory of 916	2068	13f8728b95a9ca527c725c440726814ffbc88eeaf9323e50958fa3a8df969372.exe	captain09876.exe
PID 2068 wrote to memory of 916	2068	13f8728b95a9ca527c725c440726814ffbc88eeaf9323e50958fa3a8df969372.exe	captain09876.exe
PID 2068 wrote to memory of 4784	2068	13f8728b95a9ca527c725c440726814ffbc88eeaf9323e50958fa3a8df969372.exe	EU1.exe
PID 2068 wrote to memory of 4784	2068	13f8728b95a9ca527c725c440726814ffbc88eeaf9323e50958fa3a8df969372.exe	EU1.exe
PID 2068 wrote to memory of 4784	2068	13f8728b95a9ca527c725c440726814ffbc88eeaf9323e50958fa3a8df969372.exe	EU1.exe
PID 916 wrote to memory of 1372	916	captain09876.exe	SETUP_~1.EXE
PID 916 wrote to memory of 1372	916	captain09876.exe	SETUP_~1.EXE
PID 916 wrote to memory of 1372	916	captain09876.exe	SETUP_~1.EXE
PID 4444 wrote to memory of 4324	4444	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4444 wrote to memory of 4324	4444	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4444 wrote to memory of 4324	4444	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4444 wrote to memory of 4324	4444	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe

C:\Users\Admin\AppData\Local\Temp\13f8728b95a9ca527c725c440726814ffbc88eeaf9323e50958fa3a8df969372.exe
"C:\Users\Admin\AppData\Local\Temp\13f8728b95a9ca527c725c440726814ffbc88eeaf9323e50958fa3a8df969372.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2068

C:\Program Files (x86)\Company\NewProduct\F0geI.exe
"C:\Program Files (x86)\Company\NewProduct\F0geI.exe"
2⤵
- Executes dropped EXE
PID:4520

C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe
"C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe"
2⤵
- Executes dropped EXE
PID:4348

C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe
"C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe"
2⤵
- Executes dropped EXE
PID:3968

C:\Program Files (x86)\Company\NewProduct\real.exe
"C:\Program Files (x86)\Company\NewProduct\real.exe"
2⤵
- Executes dropped EXE
PID:1700

C:\Program Files (x86)\Company\NewProduct\safert44.exe
"C:\Program Files (x86)\Company\NewProduct\safert44.exe"
2⤵
- Executes dropped EXE
PID:648

C:\Program Files (x86)\Company\NewProduct\captain09876.exe
"C:\Program Files (x86)\Company\NewProduct\captain09876.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:916

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1372

C:\Program Files (x86)\Company\NewProduct\EU1.exe
"C:\Program Files (x86)\Company\NewProduct\EU1.exe"
2⤵
- Executes dropped EXE
PID:4784

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3404

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4880

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4444

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4920

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4524

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4324

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4768

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5028

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:2036

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:192

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:5972

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Company\NewProduct\EU1.exe
Filesize
274KB

MD5
eb95bd35b211240a79cdae0f92b3c3be

SHA1
e38380e708f8edac8c22339222f53e5f4d31edeb

SHA256
ca001eae20029c736e73e2fc9e77a1e7eac73d863b05a9f580ed04b003ffba47

SHA512
13c1c49bd37a52920d09c6895883da2a33a4f79fe11a1fe2fb53e69d11beb515d8e98ad77ff76a29e662a1f84920311285c28d11eb85c68a2e3cdfd9c2563d48

Download Submit
C:\Program Files (x86)\Company\NewProduct\EU1.exe
Filesize
274KB

MD5
eb95bd35b211240a79cdae0f92b3c3be

SHA1
e38380e708f8edac8c22339222f53e5f4d31edeb

SHA256
ca001eae20029c736e73e2fc9e77a1e7eac73d863b05a9f580ed04b003ffba47

SHA512
13c1c49bd37a52920d09c6895883da2a33a4f79fe11a1fe2fb53e69d11beb515d8e98ad77ff76a29e662a1f84920311285c28d11eb85c68a2e3cdfd9c2563d48

Download Submit
C:\Program Files (x86)\Company\NewProduct\F0geI.exe
Filesize
339KB

MD5
501e0f6fa90340e3d7ff26f276cd582e

SHA1
1bce4a6153f71719e786f8f612fbfcd23d3e130a

SHA256
f07d918c6571f11abf9ab7268ac6e2ecbcd931c3d9d878895c777d15052aae2b

SHA512
dee3aabfca7912f15b628253222cfe8d8e13cd64f0438e8d705b68b0a14b4c9523b7a207583be7b424e444d6b05f237484a0c38bf2e075d347ef937d409a3a69

Download Submit
C:\Program Files (x86)\Company\NewProduct\F0geI.exe
Filesize
339KB

MD5
501e0f6fa90340e3d7ff26f276cd582e

SHA1
1bce4a6153f71719e786f8f612fbfcd23d3e130a

SHA256
f07d918c6571f11abf9ab7268ac6e2ecbcd931c3d9d878895c777d15052aae2b

SHA512
dee3aabfca7912f15b628253222cfe8d8e13cd64f0438e8d705b68b0a14b4c9523b7a207583be7b424e444d6b05f237484a0c38bf2e075d347ef937d409a3a69

Download Submit
C:\Program Files (x86)\Company\NewProduct\captain09876.exe
Filesize
704KB

MD5
ce94ce7de8279ecf9519b12f124543c3

SHA1
be2563e381439ed33869a052391eec1ddd40faa0

SHA256
f88d6fc5fd36ef3a9c54cf7101728a39a2a2694a0a64f6af1e1befacfbc03f20

SHA512
9697cfc31b3344a2929b02ecdf9235756f4641dbb0910e9f6099382916447e2d06e41c153fad50890823f068ae412fb9a55fd274b3b9c7929f2ca972112cc5b7

Download Submit
C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe
Filesize
764KB

MD5
8044b9ea12d49d849f8b516ac3d8173b

SHA1
68a078e750dad5befd1212a62c903379c1e3525c

SHA256
22850fcde13fdc68136d790dee2f85d48069a029a618ceddfd4c6f90b9845d81

SHA512
44df6449741275a07f7a3eeb718a1cff7ab6004a5b7501f28fe4269f8601b6ad2a3e6a7beeff0b41e3f2bdf24b6906d49e04b150ae75a33f9537665e4f39eb28

Download Submit
C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe
Filesize
764KB

MD5
8044b9ea12d49d849f8b516ac3d8173b

SHA1
68a078e750dad5befd1212a62c903379c1e3525c

SHA256
22850fcde13fdc68136d790dee2f85d48069a029a618ceddfd4c6f90b9845d81

SHA512
44df6449741275a07f7a3eeb718a1cff7ab6004a5b7501f28fe4269f8601b6ad2a3e6a7beeff0b41e3f2bdf24b6906d49e04b150ae75a33f9537665e4f39eb28

Download Submit
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe
Filesize
107KB

MD5
bbd8ea73b7626e0ca5b91d355df39b7f

SHA1
66e298653beb7f652eb44922010910ced6242879

SHA256
1aa3fdc24e789b01a39944b85c99e4ac08864d2eae7530164cea2821acbf184e

SHA512
625cc9c108b4660030be1282493700e5f0ccfb973f466f61254ed1e1a96f5f042cdeaa94607825a2f694647468e2f525a6451542fe3aac785ebac1ccfe39864f

Download Submit
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe
Filesize
107KB

MD5
bbd8ea73b7626e0ca5b91d355df39b7f

SHA1
66e298653beb7f652eb44922010910ced6242879

SHA256
1aa3fdc24e789b01a39944b85c99e4ac08864d2eae7530164cea2821acbf184e

SHA512
625cc9c108b4660030be1282493700e5f0ccfb973f466f61254ed1e1a96f5f042cdeaa94607825a2f694647468e2f525a6451542fe3aac785ebac1ccfe39864f

Download Submit
C:\Program Files (x86)\Company\NewProduct\real.exe
Filesize
275KB

MD5
a2414bb5522d3844b6c9a84537d7ce43

SHA1
56c91fc4fe09ce07320c03f186f3d5d293a6089d

SHA256
31f4715777f3be6a4a7b34baf25ebfc7af32dd9a2aae826fc73dca6c44fda173

SHA512
408ebb002b3bdb77dc243ced28d852801e68e5ff0dbfa450d3e91b89311fe6a3e8473e749619c285c1a5427d8a117350a3798435ed38b56d1a230f0ae270ec60

Download Submit
C:\Program Files (x86)\Company\NewProduct\real.exe
Filesize
275KB

MD5
a2414bb5522d3844b6c9a84537d7ce43

SHA1
56c91fc4fe09ce07320c03f186f3d5d293a6089d

SHA256
31f4715777f3be6a4a7b34baf25ebfc7af32dd9a2aae826fc73dca6c44fda173

SHA512
408ebb002b3bdb77dc243ced28d852801e68e5ff0dbfa450d3e91b89311fe6a3e8473e749619c285c1a5427d8a117350a3798435ed38b56d1a230f0ae270ec60

Download Submit
C:\Program Files (x86)\Company\NewProduct\safert44.exe
Filesize
246KB

MD5
414ffd7094c0f50662ffa508ca43b7d0

SHA1
6ec67bd53da2ff3d5538a3afcc6797af1e5a53fb

SHA256
d3fb9c24b34c113992c5c658f6a11f9620da2e49d12d1acabe871e1bea7846ee

SHA512
c6527077b4822c062e32c39be06e285916b501a358991d120a469f5da1e13d282685ca7ca3fa938292d5beef073fbea42ff9ba96fa5c395f057f7c964608a399

Download Submit
C:\Program Files (x86)\Company\NewProduct\safert44.exe
Filesize
246KB

MD5
414ffd7094c0f50662ffa508ca43b7d0

SHA1
6ec67bd53da2ff3d5538a3afcc6797af1e5a53fb

SHA256
d3fb9c24b34c113992c5c658f6a11f9620da2e49d12d1acabe871e1bea7846ee

SHA512
c6527077b4822c062e32c39be06e285916b501a358991d120a469f5da1e13d282685ca7ca3fa938292d5beef073fbea42ff9ba96fa5c395f057f7c964608a399

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\71RRL5JK.cookie
Filesize
256B

MD5
6c82b78e94043f96de4b79617d04bf23

SHA1
96f677f62849ac4f45d3753cb99e244278d0e28d

SHA256
f17cdcefd2636dccb3c3668ee256b945fd6de7771ef149215db606eb165c20b2

SHA512
b6406f19e35324a2055208cdcd976917764e8e18340c1081de7f7cc48ca0ad7bba5de97edfe7788c3e219ac7720f06126e4171edbffdc58cb22cedfd52a4d24d

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\JZ6VHFE0.cookie
Filesize
340B

MD5
e756039f161cb78771a3addc51be7d0e

SHA1
ca2458f6492dda53eaafa6810da68ae835f4943b

SHA256
35471b696d256eec19153e6f56a015e1d0f073e87cc639f9520043449c1da255

SHA512
e2e2e5c691462d65d7a70b7ef3ef3ac9b52e2636de1b2157182eb134186a551d5425fabebcfacf291fc70d1768df506de32998cbeb86386896de965448b0d1a3

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\W7X82X70.cookie
Filesize
172B

MD5
e00b58a316d2d7bd7dfb93c7800fec36

SHA1
0af46b7a599f4f9d75d4cf1f8d554f7e899bce83

SHA256
8a40fdb8167b80c02ecba49ecf4aa3e1e5a1244c88d6b78bdf7dd201711f5aa0

SHA512
481a7d2d396d5f959079902c66f2801e0ea10dad9826edf2477008cd85ad277da29b4680134f622608f5ca68c24f9439310f2a65318b44fe97916ff284e45a17

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\Z3QJP1BL.cookie
Filesize
424B

MD5
c7f99dd6e95190edc056ad8ccde24b26

SHA1
2261a5966f8d7e960bf9a45f8c326b5a5cee12e0

SHA256
8a46dae8f516a3bf38054f545e3c9a73b16d0845f4a249536ab677e8700d9306

SHA512
3fa4b78cedaf2066d75deed6cc8373cc5443991e007f33c28a9012b7e4eeb059117fae84a0ff1de19f496e55732ef5cfb9083dad869727efc25bf0bbc4237edf

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Filesize
717B

MD5
ec8ff3b1ded0246437b1472c69dd1811

SHA1
d813e874c2524e3a7da6c466c67854ad16800326

SHA256
e634c2d1ed20e0638c95597adf4c9d392ebab932d3353f18af1e4421f4bb9cab

SHA512
e967b804cbf2d6da30a532cbc62557d09bd236807790040c6bee5584a482dc09d724fc1d9ac0de6aa5b4e8b1fff72c8ab3206222cc2c95a91035754ac1257552

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Filesize
192B

MD5
a6cf7f71ab5ee3b8f0dd4ec4bd4911ef

SHA1
0949c8901ca38a0f312c14c19a249709b3b06e3f

SHA256
4227bae954c699ca06be4ba1d3efe521c462d4de6a05ced0f881fa37e1963df8

SHA512
6a095052779856ed73533fa2dbac605465419ca037ec253b7252ac27c5552cc1448a1554f97c02520cd7ded5b6db86f6a0f4dc5a9104e21b7ea21c6bae1d6a97

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Filesize
192B

MD5
a6cf7f71ab5ee3b8f0dd4ec4bd4911ef

SHA1
0949c8901ca38a0f312c14c19a249709b3b06e3f

SHA256
4227bae954c699ca06be4ba1d3efe521c462d4de6a05ced0f881fa37e1963df8

SHA512
6a095052779856ed73533fa2dbac605465419ca037ec253b7252ac27c5552cc1448a1554f97c02520cd7ded5b6db86f6a0f4dc5a9104e21b7ea21c6bae1d6a97

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Filesize
192B

MD5
a6cf7f71ab5ee3b8f0dd4ec4bd4911ef

SHA1
0949c8901ca38a0f312c14c19a249709b3b06e3f

SHA256
4227bae954c699ca06be4ba1d3efe521c462d4de6a05ced0f881fa37e1963df8

SHA512
6a095052779856ed73533fa2dbac605465419ca037ec253b7252ac27c5552cc1448a1554f97c02520cd7ded5b6db86f6a0f4dc5a9104e21b7ea21c6bae1d6a97

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Filesize
192B

MD5
276e30bf96e4929fb581b8ce0d1e5935

SHA1
a50f59e57fd28b9dfcfafcdfa33979d250b1be0e

SHA256
f6847d49f3bfbbba1b495ffe08c09176150f7cb11b00e0f79c589915a88dff82

SHA512
e3c2b1d9d0db49209ecfb40f064970b5c81679aa2bafa4e6b0fe927c5e649d02c93b098803a7f1148caf2e80c578e95d3da0eaa72506869a7cdde69c9b2795a7

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Filesize
192B

MD5
cdf2eaefd2187b526a5aa4ba532c42dd

SHA1
8792b84c8b3bcdb8aa8cbfaaea1fef567d178c7a

SHA256
41e47f7759dacedaadfd82ffc6bf340dcf737bbca7210e909ddadc2ea8014dba

SHA512
2c983e2fb0c2a5d4a1ef32746519524184cee34bb077299995d57938772716fceeefc3d75e6ad3e4633d209452e432f148fdde0a3e1ef76f55e8b0c3137a1646

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Filesize
192B

MD5
cdf2eaefd2187b526a5aa4ba532c42dd

SHA1
8792b84c8b3bcdb8aa8cbfaaea1fef567d178c7a

SHA256
41e47f7759dacedaadfd82ffc6bf340dcf737bbca7210e909ddadc2ea8014dba

SHA512
2c983e2fb0c2a5d4a1ef32746519524184cee34bb077299995d57938772716fceeefc3d75e6ad3e4633d209452e432f148fdde0a3e1ef76f55e8b0c3137a1646

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\Windows\3720402701\2219095117.pri
Filesize
207KB

MD5
e2b88765ee31470114e866d939a8f2c6

SHA1
e0a53b8511186ff308a0507b6304fb16cabd4e1f

SHA256
523e419d2fa2e780239812d36caa37e92f8c3e6a5cd9f18f0d807c593effa45e

SHA512
462e8e6b4e63fc6781b6a9935b332a1dc77bfb88e1de49134f86fd46bd1598d2e842902dd9415a328e325bd7cdee766bd9473f2695acdfa769ffe7ba9ae1953d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
Filesize
253.9MB

MD5
5f8d15eb02a1719175d44a5acbf78ece

SHA1
a3d4baedc349231734aca9f004e68d0749b456b0

SHA256
0303a2bfe0cd9e0099e3af7faa94f6c171fe89b306d376ca71a9eca3c704e455

SHA512
42f359d5f1c995c852fa9af8a950da6054873ec34d52b20fba28b71d07cae15ee9478408ea986ff122c7e42a7ba51118bf022e792338f3a34d8c5c135109529d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
Filesize
334.1MB

MD5
ce25658ac9291c713590b834d96406bb

SHA1
5a45881222b0e35968427eaf3185c9534ad54943

SHA256
0dfa582e65cf4e9ea1fd9575518fff57b71b3f0f850df643319c611d39a8c2c2

SHA512
8f7bee11566fa8978a0e1716b51ba4e7735e98fc715a9eed0fb3b6e156abfa46f378035935b5ed8967f98bcb3ef83599208a00225bbf0cb2655306846e3d354c

Download Submit
memory/648-423-0x00000000001D0000-0x0000000000214000-memory.dmp

Filesize
272KB

Download
memory/648-696-0x0000000004EF0000-0x0000000004F66000-memory.dmp

Filesize
472KB

Download
memory/648-265-0x0000000000000000-mapping.dmp

Download
memory/648-571-0x00000000050E0000-0x00000000056E6000-memory.dmp

Filesize
6.0MB

Download
memory/648-573-0x0000000004B50000-0x0000000004B62000-memory.dmp

Filesize
72KB

Download
memory/648-576-0x0000000004C80000-0x0000000004D8A000-memory.dmp

Filesize
1.0MB

Download
memory/648-894-0x0000000006AA0000-0x0000000006AF0000-memory.dmp

Filesize
320KB

Download
memory/648-608-0x0000000004C20000-0x0000000004C6B000-memory.dmp

Filesize
300KB

Download
memory/648-871-0x0000000007380000-0x00000000078AC000-memory.dmp

Filesize
5.2MB

Download
memory/648-477-0x0000000000920000-0x0000000000926000-memory.dmp

Filesize
24KB

Download
memory/648-704-0x0000000005790000-0x0000000005822000-memory.dmp

Filesize
584KB

Download
memory/648-709-0x0000000006100000-0x00000000065FE000-memory.dmp

Filesize
5.0MB

Download
memory/648-866-0x00000000068D0000-0x0000000006A92000-memory.dmp

Filesize
1.8MB

Download
memory/916-271-0x0000000000000000-mapping.dmp

Download
memory/1372-691-0x00000000055E0000-0x000000000581A000-memory.dmp

Filesize
2.2MB

Download
memory/1372-603-0x0000000000320000-0x0000000000370000-memory.dmp

Filesize
320KB

Download
memory/1372-479-0x0000000000000000-mapping.dmp

Download
memory/1700-259-0x0000000000000000-mapping.dmp

Download
memory/2068-151-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-155-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-168-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-167-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-169-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-170-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-171-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-172-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-173-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-174-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-175-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-176-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-177-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-178-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-179-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-180-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-181-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-182-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-183-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-121-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-166-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-165-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-132-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-164-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-163-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-162-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-161-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-160-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-159-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-158-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-157-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-156-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-122-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-131-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-154-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-153-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-152-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-120-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-150-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-123-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-124-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-125-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-126-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-149-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-147-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-148-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-146-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-144-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-145-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-143-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-142-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-141-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-127-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-140-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-139-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-138-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-137-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-136-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-135-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-134-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-128-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-129-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-130-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2068-133-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/3968-251-0x0000000000000000-mapping.dmp

Download
memory/4348-255-0x0000000000000000-mapping.dmp

Download
memory/4348-422-0x0000000000D40000-0x0000000000D60000-memory.dmp

Filesize
128KB

Download
memory/4348-738-0x0000000007E00000-0x0000000007E66000-memory.dmp

Filesize
408KB

Download
memory/4348-721-0x0000000006A20000-0x0000000006A3E000-memory.dmp

Filesize
120KB

Download
memory/4348-594-0x0000000005F20000-0x0000000005F5E000-memory.dmp

Filesize
248KB

Download
memory/4520-413-0x00000000007AA000-0x00000000007BB000-memory.dmp

Filesize
68KB

Download
memory/4520-417-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4520-639-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4520-637-0x0000000000470000-0x00000000005BA000-memory.dmp

Filesize
1.3MB

Download
memory/4520-634-0x00000000007AA000-0x00000000007BB000-memory.dmp

Filesize
68KB

Download
memory/4520-821-0x00000000007AA000-0x00000000007BB000-memory.dmp

Filesize
68KB

Download
memory/4520-415-0x0000000000470000-0x00000000005BA000-memory.dmp

Filesize
1.3MB

Download
memory/4520-250-0x0000000000000000-mapping.dmp

Download
memory/4784-279-0x0000000000000000-mapping.dmp

Download