Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
08/02/2023, 12:47
Static task
static1
Behavioral task
behavioral1
Sample
JJSploit Installer.exe
Resource
win10-20220812-en
General
-
Target
JJSploit Installer.exe
-
Size
50.0MB
-
MD5
662d26b4e627e44a0da5e5e99fa41942
-
SHA1
93ea678ba8449bfdfd7a26e82fae39f00185e8d8
-
SHA256
30e248df598327c72d4f293fe8e69dd11e91494476e9ae56557bce939833bb7b
-
SHA512
284078b1afaf2ff213aecf30fb298a6cf026cbf884227bc6864fedc60a40770a264a3b1a601b9fc1094e9bf1d8a0213359841631e5c83f1232c7db08a6b72cda
-
SSDEEP
1572864:G78WsLBU07HgOYzXNfeZtTJt0mwS8LlMUzD2:G78WGBU0036T7mLlMUzK
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Control Panel\International\Geo\Nation JJS-UI.exe Key value queried \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Control Panel\International\Geo\Nation JJS-UI.exe -
Executes dropped EXE 4 IoCs
pid Process 420 JJS-UI.exe 3332 JJS-UI.exe 3632 JJS-UI.exe 5012 JJS-UI.exe -
Loads dropped DLL 15 IoCs
pid Process 4240 JJSploit Installer.exe 4240 JJSploit Installer.exe 4240 JJSploit Installer.exe 4240 JJSploit Installer.exe 4240 JJSploit Installer.exe 4240 JJSploit Installer.exe 4240 JJSploit Installer.exe 420 JJS-UI.exe 420 JJS-UI.exe 3632 JJS-UI.exe 5012 JJS-UI.exe 3332 JJS-UI.exe 3332 JJS-UI.exe 3332 JJS-UI.exe 3332 JJS-UI.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdge.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdgeCP.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
pid pid_target Process procid_target 5676 1892 WerFault.exe 95 5704 3896 WerFault.exe 96 -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 1448 tasklist.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\MigrationTime = d581f14b6daed801 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\InternetRegistry MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheLimit = "1" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\UUID = "{12076AA4-F2D7-4D8A-8DC1-E4707BEE3B94}" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DOMStorage MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main\OperationalData = "1" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\LastClosedWidth = "800" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites\Order = 0c0000000a000000000000000c0000000100000000000000 MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 01000000234af6465b0c5e75316062c0a48d1206d3857a843c29c98f089b793be631036cb0a9752a548de3ffaefe2d0ea9565db4cc49f98e827c799546c0878f5d61b6c9443ae3690c7bbf05c454454a72f58e480a8fcc667f4d3104e86ebf447af6be00599c92ba37f63f4e2c03b16a7c88f0fa4ff50715d6ba31ae4146b4170010633bc36e1f797a1e793a55abdc15c430058b771c5bda5ee56552c0e6db52afce440d6a529d8bcc13741e46ec4eb43a0e125eaca4e7d7a3ecec9a22f06ec9d452658024e7fb54a7f562681266cac03240e3ea862dfec928f17ff05402a16769bbb9608acc7eb6d0e4e6994fb9c414d9e7a375ae57b0d3f612e317e1bd5852202922e563a30a239a001f10f5843a7490232b1d67c34e594471aba566c24f929fbb85a3250b92c1cb69089eba69c6954f154c38520fcee8752d283bd0af3455d39378d68ca34ea0973f87f1b6077cea15db48ff04dc7437da65f59a6b2674bc0bd039ec7d0d66f4fda231cfe0fe75f1c7968a8beaca1c28733b4384f3c5e3383292b17370e8736fcfb20b18f6ee052279672224b57928ec90cd2669a35a18397f81a77afcbffc85f1eb MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\InProgressFlags = "262144" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url2 = "https://login.aliexpress.com/" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "256000" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url1 = "https://www.facebook.com/" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PageSetup MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\AllComplete = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CacheLimit = "1" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B7216 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CacheLimit = "1" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\InProgressFlags = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 010000003bb9c847131fb1a5b5098a781cf6b85d6b2cafea7795334d6036a18ca4bfd7cfe2df651e184b16546da524d105c26839f8e7a1778a03cbdcba0a297a09e23568ff97aa8620c40883535a8b17ca20cd8e8ed37aa8edbf3ad102ac MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\ManagerHistoryComplete = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DontShowMeThisDialogAgain MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus MicrosoftEdgeCP.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 4240 JJSploit Installer.exe 4240 JJSploit Installer.exe 1448 tasklist.exe 1448 tasklist.exe 3632 JJS-UI.exe 3632 JJS-UI.exe 5012 JJS-UI.exe 5012 JJS-UI.exe 3416 chrome.exe 3416 chrome.exe 4972 chrome.exe 4972 chrome.exe 2976 chrome.exe 2976 chrome.exe 5988 chrome.exe 5988 chrome.exe 5432 chrome.exe 5432 chrome.exe 5496 chrome.exe 5496 chrome.exe 5708 chrome.exe 5708 chrome.exe -
Suspicious behavior: MapViewOfSection 4 IoCs
pid Process 3360 MicrosoftEdgeCP.exe 3360 MicrosoftEdgeCP.exe 3360 MicrosoftEdgeCP.exe 3360 MicrosoftEdgeCP.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeDebugPrivilege 1448 tasklist.exe Token: SeSecurityPrivilege 4240 JJSploit Installer.exe Token: SeDebugPrivilege 4464 MicrosoftEdge.exe Token: SeDebugPrivilege 4464 MicrosoftEdge.exe Token: SeDebugPrivilege 4464 MicrosoftEdge.exe Token: SeDebugPrivilege 4464 MicrosoftEdge.exe Token: SeDebugPrivilege 3896 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 3896 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 3896 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 3896 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4464 MicrosoftEdge.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe 4972 chrome.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4464 MicrosoftEdge.exe 3360 MicrosoftEdgeCP.exe 3360 MicrosoftEdgeCP.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4240 wrote to memory of 3580 4240 JJSploit Installer.exe 66 PID 4240 wrote to memory of 3580 4240 JJSploit Installer.exe 66 PID 4240 wrote to memory of 3580 4240 JJSploit Installer.exe 66 PID 3580 wrote to memory of 1448 3580 cmd.exe 68 PID 3580 wrote to memory of 1448 3580 cmd.exe 68 PID 3580 wrote to memory of 1448 3580 cmd.exe 68 PID 3580 wrote to memory of 2724 3580 cmd.exe 69 PID 3580 wrote to memory of 2724 3580 cmd.exe 69 PID 3580 wrote to memory of 2724 3580 cmd.exe 69 PID 420 wrote to memory of 3332 420 JJS-UI.exe 76 PID 420 wrote to memory of 3332 420 JJS-UI.exe 76 PID 420 wrote to memory of 3332 420 JJS-UI.exe 76 PID 420 wrote to memory of 3332 420 JJS-UI.exe 76 PID 420 wrote to memory of 3332 420 JJS-UI.exe 76 PID 420 wrote to memory of 3332 420 JJS-UI.exe 76 PID 420 wrote to memory of 3332 420 JJS-UI.exe 76 PID 420 wrote to memory of 3332 420 JJS-UI.exe 76 PID 420 wrote to memory of 3332 420 JJS-UI.exe 76 PID 420 wrote to memory of 3332 420 JJS-UI.exe 76 PID 420 wrote to memory of 3332 420 JJS-UI.exe 76 PID 420 wrote to memory of 3332 420 JJS-UI.exe 76 PID 420 wrote to memory of 3332 420 JJS-UI.exe 76 PID 420 wrote to memory of 3332 420 JJS-UI.exe 76 PID 420 wrote to memory of 3332 420 JJS-UI.exe 76 PID 420 wrote to memory of 3332 420 JJS-UI.exe 76 PID 420 wrote to memory of 3332 420 JJS-UI.exe 76 PID 420 wrote to memory of 3332 420 JJS-UI.exe 76 PID 420 wrote to memory of 3332 420 JJS-UI.exe 76 PID 420 wrote to memory of 3332 420 JJS-UI.exe 76 PID 420 wrote to memory of 3332 420 JJS-UI.exe 76 PID 420 wrote to memory of 3332 420 JJS-UI.exe 76 PID 420 wrote to memory of 3332 420 JJS-UI.exe 76 PID 420 wrote to memory of 3332 420 JJS-UI.exe 76 PID 420 wrote to memory of 3332 420 JJS-UI.exe 76 PID 420 wrote to memory of 3332 420 JJS-UI.exe 76 PID 420 wrote to memory of 3332 420 JJS-UI.exe 76 PID 420 wrote to memory of 3332 420 JJS-UI.exe 76 PID 420 wrote to memory of 3332 420 JJS-UI.exe 76 PID 420 wrote to memory of 3332 420 JJS-UI.exe 76 PID 420 wrote to memory of 3332 420 JJS-UI.exe 76 PID 420 wrote to memory of 3332 420 JJS-UI.exe 76 PID 420 wrote to memory of 3332 420 JJS-UI.exe 76 PID 420 wrote to memory of 3332 420 JJS-UI.exe 76 PID 420 wrote to memory of 3332 420 JJS-UI.exe 76 PID 420 wrote to memory of 3332 420 JJS-UI.exe 76 PID 420 wrote to memory of 3332 420 JJS-UI.exe 76 PID 420 wrote to memory of 3332 420 JJS-UI.exe 76 PID 420 wrote to memory of 3332 420 JJS-UI.exe 76 PID 420 wrote to memory of 3332 420 JJS-UI.exe 76 PID 420 wrote to memory of 3332 420 JJS-UI.exe 76 PID 420 wrote to memory of 3632 420 JJS-UI.exe 77 PID 420 wrote to memory of 3632 420 JJS-UI.exe 77 PID 420 wrote to memory of 3632 420 JJS-UI.exe 77 PID 420 wrote to memory of 5012 420 JJS-UI.exe 78 PID 420 wrote to memory of 5012 420 JJS-UI.exe 78 PID 420 wrote to memory of 5012 420 JJS-UI.exe 78 PID 4972 wrote to memory of 2884 4972 chrome.exe 80 PID 4972 wrote to memory of 2884 4972 chrome.exe 80 PID 4972 wrote to memory of 3584 4972 chrome.exe 81 PID 4972 wrote to memory of 3584 4972 chrome.exe 81 PID 4972 wrote to memory of 3584 4972 chrome.exe 81 PID 4972 wrote to memory of 3584 4972 chrome.exe 81 PID 4972 wrote to memory of 3584 4972 chrome.exe 81 PID 4972 wrote to memory of 3584 4972 chrome.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\JJSploit Installer.exe"C:\Users\Admin\AppData\Local\Temp\JJSploit Installer.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Windows\SysWOW64\cmd.execmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq JJS-UI.exe" | %SYSTEMROOT%\System32\find.exe "JJS-UI.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Windows\SysWOW64\tasklist.exetasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq JJS-UI.exe"3⤵
- Enumerates processes with tasklist
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1448
-
-
C:\Windows\SysWOW64\find.exeC:\Windows\System32\find.exe "JJS-UI.exe"3⤵PID:2724
-
-
-
C:\Users\Admin\AppData\Local\Programs\JJS-UI\JJS-UI.exe"C:\Users\Admin\AppData\Local\Programs\JJS-UI\JJS-UI.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:420 -
C:\Users\Admin\AppData\Local\Programs\JJS-UI\JJS-UI.exe"C:\Users\Admin\AppData\Local\Programs\JJS-UI\JJS-UI.exe" --type=gpu-process --field-trial-handle=1608,13248171221138399431,4850798616509006651,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --gpu-preferences=KAAAAAAAAADgAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --mojo-platform-channel-handle=1628 --ignored=" --type=renderer " /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3332
-
-
C:\Users\Admin\AppData\Local\Programs\JJS-UI\JJS-UI.exe"C:\Users\Admin\AppData\Local\Programs\JJS-UI\JJS-UI.exe" --type=utility --field-trial-handle=1608,13248171221138399431,4850798616509006651,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2032 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3632
-
-
C:\Users\Admin\AppData\Local\Programs\JJS-UI\JJS-UI.exe"C:\Users\Admin\AppData\Local\Programs\JJS-UI\JJS-UI.exe" --type=renderer --field-trial-handle=1608,13248171221138399431,4850798616509006651,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --app-path="C:\Users\Admin\AppData\Local\Programs\JJS-UI\resources\app.asar" --no-sandbox --no-zygote --preload="C:\Users\Admin\AppData\Local\Programs\JJS-UI\resources\app.asar\build\preload.js" --enable-remote-module --background-color=#fff --enable-websql --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2108 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:5012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xcc,0xd0,0xd4,0x64,0xd8,0x7ffb23874f50,0x7ffb23874f60,0x7ffb23874f702⤵PID:2884
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1548 /prefetch:22⤵PID:3584
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1744 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2344 /prefetch:82⤵PID:4112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2620 /prefetch:12⤵PID:3448
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2600 /prefetch:12⤵PID:4624
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3600 /prefetch:12⤵PID:3960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3860 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4368 /prefetch:82⤵PID:4984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4644 /prefetch:82⤵PID:3524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4504 /prefetch:82⤵PID:2972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5144 /prefetch:82⤵PID:5944
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5244 /prefetch:82⤵PID:5980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4792 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5136 /prefetch:82⤵PID:6020
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5248 /prefetch:82⤵PID:6088
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:12⤵PID:5508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4740 /prefetch:82⤵PID:3492
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4548 /prefetch:82⤵PID:2156
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4596 /prefetch:82⤵PID:2480
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4632 /prefetch:82⤵PID:3408
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6104 /prefetch:82⤵PID:5688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6076 /prefetch:82⤵PID:5656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6052 /prefetch:82⤵PID:5644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4392 /prefetch:82⤵PID:3200
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5924 /prefetch:82⤵PID:5624
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4336 /prefetch:82⤵PID:4176
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4492 /prefetch:82⤵PID:2292
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6164 /prefetch:82⤵PID:4052
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6368 /prefetch:82⤵PID:3076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6272 /prefetch:82⤵PID:4804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6320 /prefetch:82⤵PID:4904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6280 /prefetch:82⤵PID:4680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5552 /prefetch:82⤵PID:4136
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5732 /prefetch:82⤵PID:3060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6032 /prefetch:82⤵PID:5952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5660 /prefetch:82⤵PID:5996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:12⤵PID:6056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1516 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6252 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5496
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2208 /prefetch:82⤵PID:5768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2948 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5708
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2580 /prefetch:82⤵PID:2188
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6304 /prefetch:82⤵PID:3240
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4464
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:4896
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:3360
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
PID:1892 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1892 -s 37522⤵
- Program crash
PID:5676
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3896 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3896 -s 36642⤵
- Program crash
PID:5704
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\5Z1D2Q1P\intersection-observer.min[1].js
Filesize5KB
MD5936a7c8159737df8dce532f9ea4d38b4
SHA18834ea22eff1bdfd35d2ef3f76d0e552e75e83c5
SHA2563ea95af77e18116ed0e8b52bb2c0794d1259150671e02994ac2a8845bd1ad5b9
SHA51254471260a278d5e740782524392249427366c56b288c302c73d643a24c96d99a487507fbe1c47e050a52144713dfeb64cd37bc6359f443ce5f8feb1a2856a70a
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\5Z1D2Q1P\scheduler[1].js
Filesize6KB
MD5053aba5b08c61a912d3b7cf8044bb6f0
SHA159729e00835ebb1c9abdaffeb19590470ee798b9
SHA256b647e216c6cdcefb653b61550aa513149d44d08528d58203634ddba833ddf148
SHA512ce3c9c89bab8f9105854b12126464d5b31ecc34d5faddb4c8712dbcce2b32c698ea36d39ad5651234cf7bb4de553bbc56ca2e5d0adab77f2d1858dbfc240c8ed
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\5Z1D2Q1P\webcomponents-ce-sd[1].js
Filesize95KB
MD57398059a27e5dbab14b01dc15ea207f5
SHA14724ae8457f9ac2c5b4d66f81292158f453beec3
SHA2568b6a6979b9ecfdab93543315ec37ca68bc68bdf46e268ebd10feba587150ab4e
SHA51201a57998f80f6d8560047cf5f5789bb24d7fffa807b31a9c583716f9efd4ea408af2844314c6fb0f97ff133e69104d9ce2791b696199a5748a1b47847514d9b7
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\AXVR8J4K\network[1].js
Filesize13KB
MD572bc842c312e3a6eaa73602389e2dbc5
SHA1a5bb1c84e5d422eaeb9f902d0a419da585cb1b5f
SHA2565a39263cc7a4ba42309ac2691354d40dc76be1ed2a82450eebc6303efc7aaed1
SHA5122fd03ff16aa0e1bef57e9c582af931873a692d081c116f1b070685f3fae8ac3c38202269bf7f1613177b5835152693941d6ec4d55517d7df6502c7fad46a05e5
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\AXVR8J4K\spf[1].js
Filesize38KB
MD5568e84d665a2e928f88ea73692edffba
SHA1f0de07cac30ef21c2711f21d2402ae7026a9e4a3
SHA256d3699efe826dcc7f466173c6a3c57ba26b199a6a761559ded793bbb32dd21330
SHA512594c2a151fe83a930965bd5f309b1f344425a05e10fd08f1bb0e11690c2745ad07731a6f5cc4dbf3370fdcf0c673cfb53809aa30ef7c1e50b91149ff1e9b44e7
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\AXVR8J4K\www-i18n-constants[1].js
Filesize4KB
MD54fb6f67e921d90edf10bffa692afa8d3
SHA120409b47043939b50c8db586a348119b0ee846a8
SHA25635368b524463f0eb4b8e1264227c4341730a761f9b41df8cb9e4190488138f6e
SHA51208753adcbe5f31b527440e953db564211a0292336dbe41da7f4a7907f9e7f3382af0aee1ab2c9522542bbf1348eb8bfa68a83347f71d5be215d3c99a231d316a
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\AXVR8J4K\www-tampering[1].js
Filesize9KB
MD5338bed5b304e89fa7c33097b74f91225
SHA1cfc9f80a49475611af3db054d3e0a2e358684f6c
SHA256263b93aacc390e680f2c5e09cdf10b209be9f0e9a80c05a34dcf6ceeb0ae92d1
SHA51291f682da01aad703df73407846b54f53c02bbe97ef38a525dfa8cf39bafb86e34ca637936b469da35cc9430d625a84231eaaa824eb21c6dda5a060ce120601aa
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\FKS5IB0W\rs=AGKMywHehyBthAkKDyrgX1euBS9-fxiOMA[1].css
Filesize75KB
MD50bf9f8170c32e1d4b47b86302977acb0
SHA1a26b00cc23f4edc438f7b1bc34f757dc9d450afd
SHA2569ffc9adb2731ee0c960d5e298e3c1df846a560ef0d5020cde0655379e48d4834
SHA512e599d4fe6fe4bfe419106bc2ac3816c5d2828534d689bf3ecc3fa6654c5983ac5f8226fc3836245edfeff0fc09ccd7913cc6348b676727af780e5f12ffbae47b
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\G2PBNGES\www-onepick[1].css
Filesize841B
MD5b182f64ebc958940b940085ec72bfd32
SHA15d11fd1d9609c99480a4cf231e35973abafee58b
SHA256f013fb8bcc8b163655a877ca39afa7f96d49356ac8b78642a94c2deb86396fc9
SHA51289b9e917f6920a4976f243e869e9a2c53f569eb1519cf3d84b50a7033f51ad505c7a11e99f70bf7536bb44d793bad2af77f93b38b84f8211cafef45c665ede94
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\R6LZ7WYF.cookie
Filesize222B
MD5cfd3f08ffabf716226bc7f30305c937c
SHA14351068469aebcf61b9b0f474e03dc42852a731d
SHA2569e03573100c39ec3382bc0975622aabfed874962897469083f00c2cd41ad643d
SHA512918890cd36ea328cd0dd6dcf103b11fdd229a67436f354495039fe4b5ab82f2884b21ef7de7b0ec0b976428cd79cb633ec0225156d9337133fb5e67b1e4c4170
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize1KB
MD531bb29ef8bcf505960bdec7314663145
SHA1608aa8d9439315e92c2a56e6720c799442514645
SHA256026d90ace2c7cec36339a526aeeb701217b838bcee0b1d4c052dfd9c27b19972
SHA5128396dea1ec61468a758956c281b9ec21f7e4a2706ea4d5209a3f0df46eecb94ea4a6d3168e0cd0cd2514be8ea32aa6721feb72d6d36eea864a9165b0852d3c0c
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Filesize4KB
MD5f7dcb24540769805e5bb30d193944dce
SHA1e26c583c562293356794937d9e2e6155d15449ee
SHA2566b88c6ac55bbd6fea0ebe5a760d1ad2cfce251c59d0151a1400701cb927e36ea
SHA512cb5ad678b0ef642bf492f32079fe77e8be20c02de267f04b545df346b25f3e4eb98bb568c4c2c483bb88f7d1826863cb515b570d620766e52476c8ee2931ea94
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Filesize4KB
MD5f7dcb24540769805e5bb30d193944dce
SHA1e26c583c562293356794937d9e2e6155d15449ee
SHA2566b88c6ac55bbd6fea0ebe5a760d1ad2cfce251c59d0151a1400701cb927e36ea
SHA512cb5ad678b0ef642bf492f32079fe77e8be20c02de267f04b545df346b25f3e4eb98bb568c4c2c483bb88f7d1826863cb515b570d620766e52476c8ee2931ea94
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Filesize4KB
MD5f7dcb24540769805e5bb30d193944dce
SHA1e26c583c562293356794937d9e2e6155d15449ee
SHA2566b88c6ac55bbd6fea0ebe5a760d1ad2cfce251c59d0151a1400701cb927e36ea
SHA512cb5ad678b0ef642bf492f32079fe77e8be20c02de267f04b545df346b25f3e4eb98bb568c4c2c483bb88f7d1826863cb515b570d620766e52476c8ee2931ea94
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_7638F332B8B62A320F9A599D313334B6
Filesize472B
MD5ed3f32fef9b843f5511bb882c0a38358
SHA1a1a60921f7cb6ab14b645c77bb7d77c20b8201ef
SHA2569a4b9e269aa66258c1d9b10fb1af899a3e669de3e244dcfd843a0bce87646f8e
SHA512c14336e5ee87435ebeb3ecdfe5ef4434288659feaaae2731995b425d18c9041a1ba0af449706cf87dabd439e9d010acd6dcda4d17df0fac24b5093fce1760336
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize724B
MD5f569e1d183b84e8078dc456192127536
SHA130c537463eed902925300dd07a87d820a713753f
SHA256287bc80237497eb8681dbf136a56cc3870dd5bd12d48051525a280ae62aab413
SHA51249553b65a8e3fc0bf98c1bc02bae5b22188618d8edf8e88e4e25932105796956ae8301c63c487e0afe368ea39a4a2af07935a808f5fb53287ef9287bc73e1012
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize410B
MD525fccbc60c143954bf24048c2bd7ee51
SHA10a58132616246eb85f9deaf0570f98ae883aa9fe
SHA256657651283ef36e1c0340297e3b8db7981e33469cfa6277a47371ea80c08cf138
SHA512b25c889591ede53a22e90812f360a81b8ff16c137a0eb0566126193aad1a6ef1f82fb1b01bc76b5634a900c78218935166be2229b29d34d3735013a0dce69fc7
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_FC0E27DF3B28ECAD6E793F5FBB75AC7F
Filesize402B
MD544230df00907595308b1164c77d26a7f
SHA14fc09670b75a6e8784188d91d68981e674674c9f
SHA2564ca6238809ce13068049da0b77f82b6a876585eba78e6b659aa5ee11ed460725
SHA51237cd2a296835b4c481b738d7d3656e62cfc7daa5ae4e8ec6930766a048b142ddc8a44e80e24374aa7db97ca9f6a581a228f7d50646def307a7bd8e90df13ae20
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Filesize340B
MD5c2bc7a0699ec753580847c386a1e99f6
SHA1da19989f02426ac2b9f0078c2821fffb3c7870eb
SHA256b7cb882623e9da56faa67107d9c76b5b495a2e3f7e8c1920916f72b562b0c69d
SHA5126324b0f78da271b3750729bce44d5237e80fcd7fd53b1ab09c6e847cc0deea69b15e5b6137ff1b9aff3b30a725023cb74155cfee287fd4899e9abaf723fcd8f3
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Filesize340B
MD5c2bc7a0699ec753580847c386a1e99f6
SHA1da19989f02426ac2b9f0078c2821fffb3c7870eb
SHA256b7cb882623e9da56faa67107d9c76b5b495a2e3f7e8c1920916f72b562b0c69d
SHA5126324b0f78da271b3750729bce44d5237e80fcd7fd53b1ab09c6e847cc0deea69b15e5b6137ff1b9aff3b30a725023cb74155cfee287fd4899e9abaf723fcd8f3
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Filesize340B
MD5c2bc7a0699ec753580847c386a1e99f6
SHA1da19989f02426ac2b9f0078c2821fffb3c7870eb
SHA256b7cb882623e9da56faa67107d9c76b5b495a2e3f7e8c1920916f72b562b0c69d
SHA5126324b0f78da271b3750729bce44d5237e80fcd7fd53b1ab09c6e847cc0deea69b15e5b6137ff1b9aff3b30a725023cb74155cfee287fd4899e9abaf723fcd8f3
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_7638F332B8B62A320F9A599D313334B6
Filesize402B
MD54b9f5ba4d15b0fafaf3d89dced151274
SHA101b838db66a356986bfc5192b1a12da41c96d83f
SHA256c6a87796dd512e3171e45e9841e6f7d0aa6eddc515415014c62676d74b88c5c1
SHA512d2c0a0c92c8ba859d1f4754f1c30eada0ed76509e2f088e7a92a674f06e9975687ccdc3a2f6bb86587227537149b65c2404f71251c4332521c274baaec0f21f0
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize392B
MD5f6e68e3626028db814951a66864ea4d8
SHA12243378eaa77a475f42a215d96c0fd5ab85c39f7
SHA256a9cfb16cfcc2673359600f7340dbe820498f02d80617076b3c15dbd02dd4d6f5
SHA5126c8853578879591d125084cc56a2cd734525c8cbc03d32b7f265d6d24c9a635957accc58dfa1d0a59a51a27627f6054b43a3f363186fb442ee994b8f0e39d192
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize392B
MD5f6e68e3626028db814951a66864ea4d8
SHA12243378eaa77a475f42a215d96c0fd5ab85c39f7
SHA256a9cfb16cfcc2673359600f7340dbe820498f02d80617076b3c15dbd02dd4d6f5
SHA5126c8853578879591d125084cc56a2cd734525c8cbc03d32b7f265d6d24c9a635957accc58dfa1d0a59a51a27627f6054b43a3f363186fb442ee994b8f0e39d192
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\Windows\3720402701\2219095117.pri
Filesize207KB
MD5e2b88765ee31470114e866d939a8f2c6
SHA1e0a53b8511186ff308a0507b6304fb16cabd4e1f
SHA256523e419d2fa2e780239812d36caa37e92f8c3e6a5cd9f18f0d807c593effa45e
SHA512462e8e6b4e63fc6781b6a9935b332a1dc77bfb88e1de49134f86fd46bd1598d2e842902dd9415a328e325bd7cdee766bd9473f2695acdfa769ffe7ba9ae1953d
-
Filesize
3.5MB
MD56bc4ada9a7cab72f49c564e6c86b4c3e
SHA1f0fba01542a0fbe585106f7efd884df65e8c89dc
SHA2567d0d1290382ea0e44a3178446a0c202696237e27dbb5f8f0827691092b8f2228
SHA512d7ec39514c104b40a42cd3ca956ba84f5a78f237a39f40d85ba54983145bce2dfbc7ec5e0cbc1bf8ab64d1d370371a7cba5e30202d2c1f37782db32486ed7f6e
-
Filesize
86.3MB
MD5f5785ecacd2d277155d5508c2da9691a
SHA19493e996f43ab114ca81c6e7471b09aaacf9cac6
SHA2569726f363853807338f7affc14689320ac9aefef3a08f030d2d9f6f1770f1f657
SHA512080f30724a0dabf1a8d6b843c47ea073448e012680213592563180281dd13fbccf5634aba51f618cbcb9737de1088abaf39319be6a8606a4f10d822ee0caa97c
-
Filesize
86.3MB
MD5f5785ecacd2d277155d5508c2da9691a
SHA19493e996f43ab114ca81c6e7471b09aaacf9cac6
SHA2569726f363853807338f7affc14689320ac9aefef3a08f030d2d9f6f1770f1f657
SHA512080f30724a0dabf1a8d6b843c47ea073448e012680213592563180281dd13fbccf5634aba51f618cbcb9737de1088abaf39319be6a8606a4f10d822ee0caa97c
-
Filesize
86.3MB
MD5f5785ecacd2d277155d5508c2da9691a
SHA19493e996f43ab114ca81c6e7471b09aaacf9cac6
SHA2569726f363853807338f7affc14689320ac9aefef3a08f030d2d9f6f1770f1f657
SHA512080f30724a0dabf1a8d6b843c47ea073448e012680213592563180281dd13fbccf5634aba51f618cbcb9737de1088abaf39319be6a8606a4f10d822ee0caa97c
-
Filesize
86.3MB
MD5f5785ecacd2d277155d5508c2da9691a
SHA19493e996f43ab114ca81c6e7471b09aaacf9cac6
SHA2569726f363853807338f7affc14689320ac9aefef3a08f030d2d9f6f1770f1f657
SHA512080f30724a0dabf1a8d6b843c47ea073448e012680213592563180281dd13fbccf5634aba51f618cbcb9737de1088abaf39319be6a8606a4f10d822ee0caa97c
-
Filesize
86.3MB
MD5f5785ecacd2d277155d5508c2da9691a
SHA19493e996f43ab114ca81c6e7471b09aaacf9cac6
SHA2569726f363853807338f7affc14689320ac9aefef3a08f030d2d9f6f1770f1f657
SHA512080f30724a0dabf1a8d6b843c47ea073448e012680213592563180281dd13fbccf5634aba51f618cbcb9737de1088abaf39319be6a8606a4f10d822ee0caa97c
-
Filesize
175KB
MD53ff806f44723cee528a1aaee4d3a289e
SHA156830e7ff31f803077aed774fafebd4e6c5e6c90
SHA25665cb11d090b32e0fb3c740a736c13c0a47cb1bcb265c084e3de5bb7474fb662f
SHA51203dafb839308d644a9943ba66838536fbd1f606cafe392f90925ce51766b5e3a9064d60ca8463bacf7238258beded570d5a0007f3ce11c14f87b10faa2da2977
-
Filesize
312KB
MD5bd66e8de6979dfe12cbaa29390d11a64
SHA1967916eb7587f0163fbce50c7b4822d06e939d5a
SHA256cd584f20aeed80fe5852d5d5656a12d25d9116d6b805ddbec3874d310925df2a
SHA512f77bd5004d8da54e8588ffcf6962b3244b8e4a9f6310d31f0c7c44d913504577c9e3fb858078705c384649fbcf26223d8f98dd02778e259a8924028f2be3bc1c
-
Filesize
2.1MB
MD5f193d766add1c6386ff6dbbccf7e176a
SHA1c467242b06dd9ad3b81f47f3fd4cb2faf320f0f1
SHA256cb7e3974970f4e306e444a4b605e4ed9a83fe62383cfa4897755c77eecec7893
SHA5128ea7dcd2a417d3cb49ff8523a250ee804158101b355f61377f967d7ff309ec743e9c3c055022179c37dc736314ed73097b601c9376d11cf34d750049ab6e1984
-
Filesize
10.0MB
MD53f019441588332ac8b79a3a3901a5449
SHA1c8930e95b78deef5b7730102acd39f03965d479a
SHA256594637e10b8f5c97157413528f0cbf5bc65b4ab9e79f5fa34fe268092655ec57
SHA512ee083ae5e93e70d5bbebe36ec482aa75c47d908df487a43db2b55ddd6b55c291606649175cf7907d6ab64fc81ead7275ec56e3193b631f8f78b10d2c775fd1a9
-
Filesize
75KB
MD5a2201115723fd61d1e68ab001e6cdca0
SHA1a97073e22adf7b300e702e717743cd249e64b4fb
SHA2563333cf1fb2b0c15ea819787ba672d2274f3136e6a8729f2e5d2796b740688183
SHA512e68c451602a0c2cd47ee3652daf1d74d87e6e61ebda9166cbb182301f03118b72288968695f85a1bcdefb45e4753ba7187dd5159b6694952f33238af39d89479
-
Filesize
8.9MB
MD55118ebd39acde0236a71fad2880add8c
SHA11daa8e701f17a793c0e70f4b0aa36fbb376962ae
SHA256e3386c5fd98dc711a70eae7a9f6bf3139de3e9a15e3a022d343a459b747c6471
SHA512925ae1d8c643e4f3c20221ae850a171e6032d9e391cf07e5efab4a4a29e8f6640973a8f0dc97704df5263ed93dfd4c32650c656fbc9874c98ab87c6131fdcaa8
-
Filesize
25.5MB
MD566c0a1c656ab24aecb609cd8a19ba260
SHA1a86f3c6b9a6d109a08122a331f58f056f269bfce
SHA25655fa1a547472dacc5b91e29ff3693ca62e155a7c1dd3dcca5e52bad5c16ba2b5
SHA512d6036159be4088b2e0a703056072254a9a00ef58921a036858e9c7c9830d397c7222fb159ff3faad3a258ae69bfbbdb3ae4f3d6f332edb350e0654cf688b4216
-
Filesize
326KB
MD5cb5e28007c9d61871ceb5dcb2b657985
SHA1f2fcd64cbcfd8657a6326c152b14f6114eb74606
SHA256c3dc1eaaf67f0a8c7bf80dcdd2830d79c5d980fca19aa854512cd69c79df8b1c
SHA51218635d1120cb983601c234bf662d85939f0046a84bfc652f680c078e52a0cfc41b2e2b3098f3a365663f14a9ea1ad51c93527370f58d57788e9ceea46b507dee
-
Filesize
2.9MB
MD534c323f53fcc4021f446fb1e4c14ff09
SHA1d4160430c8fb300d7d5505fc08d671e53f1e1b6b
SHA2566202bf896139be5e8d7f38ffa1e68c65828ccfe02c33e7912c67883031f4647a
SHA512e591366d71edf938ea5b921b2efd1647c73a97442c2fbe038f1f35e2fec0323848c20e6858189f655ff222672a40b3d8d31e1cb7bcb22cb00597e71d5172f655
-
Filesize
541KB
MD5bd06321191c06413bb9c15c3987859ef
SHA1eb6a73a3429f3151632a05d5ca5e3590b782ed85
SHA256cfbc1a5e921074913a87b1ce7d6d99cb4accf6d7926d242bd264846142dc635d
SHA51248ddbd1d8c77857b2a2bee65f4b903441bd675fc7bf53e96be2a78557f85c00f27344e7cdd29352ec9977417b991316365d66f5e40b4b9884415693aba283ded
-
Filesize
3.5MB
MD56bc4ada9a7cab72f49c564e6c86b4c3e
SHA1f0fba01542a0fbe585106f7efd884df65e8c89dc
SHA2567d0d1290382ea0e44a3178446a0c202696237e27dbb5f8f0827691092b8f2228
SHA512d7ec39514c104b40a42cd3ca956ba84f5a78f237a39f40d85ba54983145bce2dfbc7ec5e0cbc1bf8ab64d1d370371a7cba5e30202d2c1f37782db32486ed7f6e
-
Filesize
2.1MB
MD5f193d766add1c6386ff6dbbccf7e176a
SHA1c467242b06dd9ad3b81f47f3fd4cb2faf320f0f1
SHA256cb7e3974970f4e306e444a4b605e4ed9a83fe62383cfa4897755c77eecec7893
SHA5128ea7dcd2a417d3cb49ff8523a250ee804158101b355f61377f967d7ff309ec743e9c3c055022179c37dc736314ed73097b601c9376d11cf34d750049ab6e1984
-
Filesize
2.1MB
MD5f193d766add1c6386ff6dbbccf7e176a
SHA1c467242b06dd9ad3b81f47f3fd4cb2faf320f0f1
SHA256cb7e3974970f4e306e444a4b605e4ed9a83fe62383cfa4897755c77eecec7893
SHA5128ea7dcd2a417d3cb49ff8523a250ee804158101b355f61377f967d7ff309ec743e9c3c055022179c37dc736314ed73097b601c9376d11cf34d750049ab6e1984
-
Filesize
2.1MB
MD5f193d766add1c6386ff6dbbccf7e176a
SHA1c467242b06dd9ad3b81f47f3fd4cb2faf320f0f1
SHA256cb7e3974970f4e306e444a4b605e4ed9a83fe62383cfa4897755c77eecec7893
SHA5128ea7dcd2a417d3cb49ff8523a250ee804158101b355f61377f967d7ff309ec743e9c3c055022179c37dc736314ed73097b601c9376d11cf34d750049ab6e1984
-
Filesize
2.1MB
MD5f193d766add1c6386ff6dbbccf7e176a
SHA1c467242b06dd9ad3b81f47f3fd4cb2faf320f0f1
SHA256cb7e3974970f4e306e444a4b605e4ed9a83fe62383cfa4897755c77eecec7893
SHA5128ea7dcd2a417d3cb49ff8523a250ee804158101b355f61377f967d7ff309ec743e9c3c055022179c37dc736314ed73097b601c9376d11cf34d750049ab6e1984
-
Filesize
326KB
MD5cb5e28007c9d61871ceb5dcb2b657985
SHA1f2fcd64cbcfd8657a6326c152b14f6114eb74606
SHA256c3dc1eaaf67f0a8c7bf80dcdd2830d79c5d980fca19aa854512cd69c79df8b1c
SHA51218635d1120cb983601c234bf662d85939f0046a84bfc652f680c078e52a0cfc41b2e2b3098f3a365663f14a9ea1ad51c93527370f58d57788e9ceea46b507dee
-
Filesize
2.9MB
MD534c323f53fcc4021f446fb1e4c14ff09
SHA1d4160430c8fb300d7d5505fc08d671e53f1e1b6b
SHA2566202bf896139be5e8d7f38ffa1e68c65828ccfe02c33e7912c67883031f4647a
SHA512e591366d71edf938ea5b921b2efd1647c73a97442c2fbe038f1f35e2fec0323848c20e6858189f655ff222672a40b3d8d31e1cb7bcb22cb00597e71d5172f655
-
Filesize
117KB
MD580b6d5f12dfe42f21dc5ec5ee793ad08
SHA153aca73b99b75191bdce2a025151848b370dfeae
SHA2560d7f23c4e4b1a3dd6e2e77465b4bbe1487a82e9681c327e48090abf3c726ec0f
SHA512236fa76c080f915f221d0584445261b87c77425400f260555395f0f5a29ca3cffb6ee8c9e477d1d4895c10406e651c8d87771f1b1de889fca5bd6bc4f818bc9d
-
Filesize
9KB
MD517309e33b596ba3a5693b4d3e85cf8d7
SHA17d361836cf53df42021c7f2b148aec9458818c01
SHA256996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
SHA5121abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
-
Filesize
100KB
MD5c6a6e03f77c313b267498515488c5740
SHA13d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA256b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
SHA5129870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
-
Filesize
12KB
MD50d7ad4f45dc6f5aa87f606d0331c6901
SHA148df0911f0484cbe2a8cdd5362140b63c41ee457
SHA2563eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
-
Filesize
3KB
MD51cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA10b9519763be6625bd5abce175dcc59c96d100d4c
SHA2569be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
SHA5127acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
-
Filesize
3KB
MD51cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA10b9519763be6625bd5abce175dcc59c96d100d4c
SHA2569be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
SHA5127acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
-
Filesize
6KB
MD5ec0504e6b8a11d5aad43b296beeb84b2
SHA191b5ce085130c8c7194d66b2439ec9e1c206497c
SHA2565d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
SHA5123f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
-
Filesize
424KB
MD580e44ce4895304c6a3a831310fbf8cd0
SHA136bd49ae21c460be5753a904b4501f1abca53508
SHA256b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
SHA512c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df