fabookie | 3eeb47199704221e7f396fa505af2b09c17daf7d034295a3b8c9777c2ac70f01

Analysis

max time kernel
300s
max time network
308s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
17-09-2023 22:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3eeb47199704221e7f396fa505af2b09c17daf7d034295a3b8c9777c2ac70f01.exe
Size

261KB
MD5

1da58894b51a9e4cb51d346868a821d5
SHA1

c9cfce9fc48ee7c252299475bb6bd940423181d1
SHA256

3eeb47199704221e7f396fa505af2b09c17daf7d034295a3b8c9777c2ac70f01
SHA512

6f206387e0ca4be32fcc6967dea0932a2433112698304f4ae6d1d1bcf4633cb1e8e59618fdce03cd3d22e64d8560c8171c0b031f96ea0c92cd4388dc1587043a
SSDEEP

3072:i2SG6IBtVVzkEmJth+9p1ORs+NJ2uvHJ5TMi473cceipyEAeAg0FujDZGfQgQwZk:iKvJm09zORs+z/TMify9DAOxqQSZcK8/

Score

10^/10

fabookie redline smokeloader 0305 backdoor google discovery infostealer phishing spyware stealer trojan

Malware Config

Extracted

Family

smokeloader

Version

2022

http://77.91.68.29/fks/

rc4.i32

Extracted

Family

redline

Botnet

0305

185.215.113.25:10195

Attributes

auth_value
c86205ff1cc37b2da12f0190adfda52c

Signatures

Detect Fabookie payload 2 IoCs

resource	yara_rule
behavioral2/memory/2848-129-0x00000000037B0000-0x00000000038E1000-memory.dmp	family_fabookie
behavioral2/memory/2848-518-0x00000000037B0000-0x00000000038E1000-memory.dmp	family_fabookie

Detected google phishing page
phishing google
Fabookie
Fabookie is facebook account info stealer.
spyware stealer fabookie
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 5 IoCs

pid	Process
4624	gsgurcs
1488	8B24.exe
2924	8C8C.exe
2120	945D.exe
2848	96DF.exe

Loads dropped DLL 1 IoCs

pid	Process
3728	regsvr32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5004 set thread context of 2288	5004	3eeb47199704221e7f396fa505af2b09c17daf7d034295a3b8c9777c2ac70f01.exe	70

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = b332a762b9e9d901	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\MrtCache	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = de02c25cb9e9d901	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListInPrivateBrowsingAllowed = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\NextUpdateDate = "401805745"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage\ProcessingFlag = 50318872b9e9d901	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\NextBrowserDataLogTime = 80d1d1c1ebe9d901	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = e98c6977b9e9d901	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\SplashScreen	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames\en-US = "en-US.1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Next Rating Prompt = f0594cb813ead901	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 69ac4e5db9e9d901	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 91e70064b9e9d901	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2288	AppLaunch.exe
2288	AppLaunch.exe
3244	Process not Found
3244	Process not Found
3244	Process not Found
3244	Process not Found
3244	Process not Found
3244	Process not Found
3244	Process not Found
3244	Process not Found
3244	Process not Found
3244	Process not Found
3244	Process not Found
3244	Process not Found
3244	Process not Found
3244	Process not Found
3244	Process not Found
3244	Process not Found
3244	Process not Found
3244	Process not Found
3244	Process not Found
3244	Process not Found
3244	Process not Found
3244	Process not Found
3244	Process not Found
3244	Process not Found
3244	Process not Found
3244	Process not Found
3244	Process not Found
3244	Process not Found
3244	Process not Found
3244	Process not Found
3244	Process not Found
3244	Process not Found
3244	Process not Found
3244	Process not Found
3244	Process not Found
3244	Process not Found
3244	Process not Found
3244	Process not Found
3244	Process not Found
3244	Process not Found
3244	Process not Found
3244	Process not Found
3244	Process not Found
3244	Process not Found
3244	Process not Found
3244	Process not Found
3244	Process not Found
3244	Process not Found
3244	Process not Found
3244	Process not Found
3244	Process not Found
3244	Process not Found
3244	Process not Found
3244	Process not Found
3244	Process not Found
3244	Process not Found
3244	Process not Found
3244	Process not Found
3244	Process not Found
3244	Process not Found
3244	Process not Found
3244	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3244	Process not Found

Suspicious behavior: MapViewOfSection 11 IoCs

pid	Process
2288	AppLaunch.exe
1424	MicrosoftEdgeCP.exe
1424	MicrosoftEdgeCP.exe
1424	MicrosoftEdgeCP.exe
1424	MicrosoftEdgeCP.exe
1424	MicrosoftEdgeCP.exe
1424	MicrosoftEdgeCP.exe
1424	MicrosoftEdgeCP.exe
1424	MicrosoftEdgeCP.exe
1424	MicrosoftEdgeCP.exe
1424	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3244	Process not Found
Token: SeCreatePagefilePrivilege	3244	Process not Found
Token: SeShutdownPrivilege	3244	Process not Found
Token: SeCreatePagefilePrivilege	3244	Process not Found
Token: SeShutdownPrivilege	3244	Process not Found
Token: SeCreatePagefilePrivilege	3244	Process not Found
Token: SeShutdownPrivilege	3244	Process not Found
Token: SeCreatePagefilePrivilege	3244	Process not Found
Token: SeShutdownPrivilege	3244	Process not Found
Token: SeCreatePagefilePrivilege	3244	Process not Found
Token: SeDebugPrivilege	1488	8B24.exe
Token: SeShutdownPrivilege	3244	Process not Found
Token: SeCreatePagefilePrivilege	3244	Process not Found
Token: SeShutdownPrivilege	3244	Process not Found
Token: SeCreatePagefilePrivilege	3244	Process not Found
Token: SeShutdownPrivilege	3244	Process not Found
Token: SeCreatePagefilePrivilege	3244	Process not Found
Token: SeShutdownPrivilege	3244	Process not Found
Token: SeCreatePagefilePrivilege	3244	Process not Found
Token: SeDebugPrivilege	352	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	352	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	352	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	352	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	3244	Process not Found
Token: SeCreatePagefilePrivilege	3244	Process not Found
Token: SeShutdownPrivilege	3244	Process not Found
Token: SeCreatePagefilePrivilege	3244	Process not Found
Token: SeShutdownPrivilege	3244	Process not Found
Token: SeCreatePagefilePrivilege	3244	Process not Found
Token: SeShutdownPrivilege	3244	Process not Found
Token: SeCreatePagefilePrivilege	3244	Process not Found
Token: SeShutdownPrivilege	3244	Process not Found
Token: SeCreatePagefilePrivilege	3244	Process not Found
Token: SeShutdownPrivilege	3244	Process not Found
Token: SeCreatePagefilePrivilege	3244	Process not Found
Token: SeShutdownPrivilege	3244	Process not Found
Token: SeCreatePagefilePrivilege	3244	Process not Found
Token: SeShutdownPrivilege	3244	Process not Found
Token: SeCreatePagefilePrivilege	3244	Process not Found
Token: SeDebugPrivilege	2924	8C8C.exe
Token: SeShutdownPrivilege	3244	Process not Found
Token: SeCreatePagefilePrivilege	3244	Process not Found
Token: SeShutdownPrivilege	3244	Process not Found
Token: SeCreatePagefilePrivilege	3244	Process not Found
Token: SeShutdownPrivilege	3244	Process not Found
Token: SeCreatePagefilePrivilege	3244	Process not Found
Token: SeShutdownPrivilege	3244	Process not Found
Token: SeCreatePagefilePrivilege	3244	Process not Found
Token: SeShutdownPrivilege	3244	Process not Found
Token: SeCreatePagefilePrivilege	3244	Process not Found
Token: SeShutdownPrivilege	3244	Process not Found
Token: SeCreatePagefilePrivilege	3244	Process not Found
Token: SeShutdownPrivilege	3244	Process not Found
Token: SeCreatePagefilePrivilege	3244	Process not Found
Token: SeShutdownPrivilege	3244	Process not Found
Token: SeCreatePagefilePrivilege	3244	Process not Found
Token: SeShutdownPrivilege	3244	Process not Found
Token: SeCreatePagefilePrivilege	3244	Process not Found
Token: SeDebugPrivilege	2676	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2676	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	3244	Process not Found
Token: SeCreatePagefilePrivilege	3244	Process not Found
Token: SeShutdownPrivilege	3244	Process not Found
Token: SeCreatePagefilePrivilege	3244	Process not Found

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2960	MicrosoftEdge.exe
1424	MicrosoftEdgeCP.exe
352	MicrosoftEdgeCP.exe
1424	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 2288	5004	3eeb47199704221e7f396fa505af2b09c17daf7d034295a3b8c9777c2ac70f01.exe	70
PID 5004 wrote to memory of 2288	5004	3eeb47199704221e7f396fa505af2b09c17daf7d034295a3b8c9777c2ac70f01.exe	70
PID 5004 wrote to memory of 2288	5004	3eeb47199704221e7f396fa505af2b09c17daf7d034295a3b8c9777c2ac70f01.exe	70
PID 5004 wrote to memory of 2288	5004	3eeb47199704221e7f396fa505af2b09c17daf7d034295a3b8c9777c2ac70f01.exe	70
PID 5004 wrote to memory of 2288	5004	3eeb47199704221e7f396fa505af2b09c17daf7d034295a3b8c9777c2ac70f01.exe	70
PID 5004 wrote to memory of 2288	5004	3eeb47199704221e7f396fa505af2b09c17daf7d034295a3b8c9777c2ac70f01.exe	70
PID 3244 wrote to memory of 1488	3244	Process not Found	72
PID 3244 wrote to memory of 1488	3244	Process not Found	72
PID 3244 wrote to memory of 1488	3244	Process not Found	72
PID 3244 wrote to memory of 2924	3244	Process not Found	73
PID 3244 wrote to memory of 2924	3244	Process not Found	73
PID 3244 wrote to memory of 2924	3244	Process not Found	73
PID 3244 wrote to memory of 2120	3244	Process not Found	75
PID 3244 wrote to memory of 2120	3244	Process not Found	75
PID 3244 wrote to memory of 2120	3244	Process not Found	75
PID 3244 wrote to memory of 2848	3244	Process not Found	76
PID 3244 wrote to memory of 2848	3244	Process not Found	76
PID 3244 wrote to memory of 4348	3244	Process not Found	77
PID 3244 wrote to memory of 4348	3244	Process not Found	77
PID 2120 wrote to memory of 3728	2120	945D.exe	79
PID 2120 wrote to memory of 3728	2120	945D.exe	79
PID 2120 wrote to memory of 3728	2120	945D.exe	79
PID 1424 wrote to memory of 4280	1424	MicrosoftEdgeCP.exe	85
PID 1424 wrote to memory of 4280	1424	MicrosoftEdgeCP.exe	85
PID 1424 wrote to memory of 4280	1424	MicrosoftEdgeCP.exe	85
PID 1424 wrote to memory of 4280	1424	MicrosoftEdgeCP.exe	85
PID 1424 wrote to memory of 4280	1424	MicrosoftEdgeCP.exe	85
PID 1424 wrote to memory of 4280	1424	MicrosoftEdgeCP.exe	85
PID 1424 wrote to memory of 4280	1424	MicrosoftEdgeCP.exe	85
PID 1424 wrote to memory of 4280	1424	MicrosoftEdgeCP.exe	85
PID 1424 wrote to memory of 4332	1424	MicrosoftEdgeCP.exe	92
PID 1424 wrote to memory of 4332	1424	MicrosoftEdgeCP.exe	92
PID 1424 wrote to memory of 4332	1424	MicrosoftEdgeCP.exe	92
PID 1424 wrote to memory of 4332	1424	MicrosoftEdgeCP.exe	92
PID 1424 wrote to memory of 4332	1424	MicrosoftEdgeCP.exe	92
PID 1424 wrote to memory of 4332	1424	MicrosoftEdgeCP.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\3eeb47199704221e7f396fa505af2b09c17daf7d034295a3b8c9777c2ac70f01.exe
"C:\Users\Admin\AppData\Local\Temp\3eeb47199704221e7f396fa505af2b09c17daf7d034295a3b8c9777c2ac70f01.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:2288

C:\Users\Admin\AppData\Roaming\gsgurcs
C:\Users\Admin\AppData\Roaming\gsgurcs
1⤵
- Executes dropped EXE
PID:4624

C:\Users\Admin\AppData\Local\Temp\8B24.exe
C:\Users\Admin\AppData\Local\Temp\8B24.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1488

C:\Users\Admin\AppData\Local\Temp\8C8C.exe
C:\Users\Admin\AppData\Local\Temp\8C8C.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2924

C:\Users\Admin\AppData\Local\Temp\945D.exe
C:\Users\Admin\AppData\Local\Temp\945D.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /U OHGqPJ.O0Z /S
  2⤵
  - Loads dropped DLL
  PID:3728

C:\Users\Admin\AppData\Local\Temp\96DF.exe
C:\Users\Admin\AppData\Local\Temp\96DF.exe
1⤵
- Executes dropped EXE
PID:2848

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9896.bat" "
1⤵
- Checks computer location settings
PID:4348

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2960

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4900

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1424

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:352

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4280

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4692

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:3008

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2676

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4332

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:3936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0G1F2NWK\edgecompatviewlist[1].xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\39AV6VAN\B8BxsscfVBr[1].ico

Filesize
1KB

MD5
e508eca3eafcc1fc2d7f19bafb29e06b

SHA1
a62fc3c2a027870d99aedc241e7d5babba9a891f

SHA256
e6d1d77403cd9f14fd2377d07e84350cfe768e3353e402bf42ebdc8593a58c9a

SHA512
49e3f31fd73e52ba274db9c7d306cc188e09c3ae683827f420fbb17534d197a503460e7ec2f1af46065f8d0b33f37400659bfa2ae165e502f97a8150e184a38c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\OIBANPIM\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\8XP0G035.cookie

Filesize
132B

MD5
1a0bcb4623539c5d01065ccf5caf0a53

SHA1
9854ccf4a994855eb4f737ea9d0d97ee6365b0c9

SHA256
fb87cce5aefcb31c3613c4333130b254c3972e5893445c1c0a73cc5561ef622d

SHA512
9e54c169bd001e14a5d34035c3d61bade2580fecfc49b98082890b0e3698840dd9d4991fa847f8404ce38cb7ca3a20233c0cc1713948fde5e652fb7678445359

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
cf7f3cad22622229134fe108d49a8ad3

SHA1
63162b8dc363509f393e0ba8d320073fa1a3fc3f

SHA256
14c1c02ee431e3a71e382582904d21c1e6d817d82845d0b92385b9cacf5fc704

SHA512
e88365dfdca9cbe8107645a7f3a98cd5bdfb7f3277ddecf348a2b464a09276d2c263e2fdc0f1e3d514e5bb1f4c1b50b231cf73040e15af67af88757404f42c7b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_BA0BAB2D4C396325C2233CA4C6557724

Filesize
472B

MD5
149a7377ce505162af15127c384d5e3b

SHA1
f4bf765455a03741b3c401204af7aadc8356e4a4

SHA256
f6731d465327021f3b3ced0bb1087faf90bf1d7b7619edb8b94dbf3f80fd3f43

SHA512
06ea8e0a9348ff73c0ca08ffde9ca5747697f80b61ae5f83e28c8ad54320398b9e9bc3a3d892921c9beb6ce55ebf7c910dbcd99bfec178b710f5e6a55fca522d

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
aa62f8ce77e072c8160c71b5df3099b0

SHA1
06b8c07db93694a3fe73a4276283fabb0e20ac38

SHA256
3eb4927c4d9097dc924fcde21b56d01d5d1ef61b7d22bfb6786e3b546b33e176

SHA512
71724e837286c5f0eb2ee4ad01ac0304d4c7597bb2d46169c342821b0da04d8597491bd27ef80e817bc77031cd29d2182ccc82ef8ea3860696875f89427c8e0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
ba8dc02de265324397b98ceed7ae868a

SHA1
24f44e232bb2db778099d35a07dac34501fe048a

SHA256
7a646ad2efc1830743a8fe37beed5ea45e95f8bc83b930f814c50a44f88c6417

SHA512
dce2fa7f230db9d050d61c5c1570fa1a49118910608a589febc4e900304e6619eabec63022856e57ac1e10786867c51562a2a3418d8da73622bee5760646b605

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_BA0BAB2D4C396325C2233CA4C6557724

Filesize
410B

MD5
786823134943ba22a6302aafb1dff089

SHA1
a76018a57e6241c96ef356ff47587b80a3128c65

SHA256
48b8a843df28f4d04d485c0b4b0ff340316b9965306ce99073a0f693c2e3a77f

SHA512
aa0eddba93e827b65c542ef62845f55234ad6996402fb1d2545ff9f79865639f3a5ada36c8d19fdd3e1b229b307008ed794672927e77a3f1d2d1fd884357fa4d

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
3d3f83a0e5fbe75b0b91fafbf87aadd1

SHA1
0ddb5f298c02f19469b7444828e8b0b0f537b5f1

SHA256
28a64abe6440df4ebf15d5fda46359ed869b336fbf9f31b056801988c74c1135

SHA512
6cbe8b861e5716944851d39309ddae04359053fe23f36fdb13443282c06a2b1c5224f6a16718d6dc4721e6275f502995dbf3467a93cfb9dc935fd8e7d2f2ba94

Download Submit
C:\Users\Admin\AppData\Local\Temp\8B24.exe

Filesize
341KB

MD5
8669fe397a7225ede807202f6a9d8390

SHA1
04a806a5c4218cb703cba85d3e636d0c8cbae043

SHA256
1624a759791e49ce8f79dd249d3ac2aede589ffbe53db342e4c99e2fbbc1b90e

SHA512
29cad49434172a910ba7635058ecc02aacf43f648ee98b2c47c561332403a96847b5da817358095f7638295b238de8874bf34fb393670096bbf3caeb388a9c45

Download Submit
C:\Users\Admin\AppData\Local\Temp\8B24.exe

Filesize
341KB

MD5
8669fe397a7225ede807202f6a9d8390

SHA1
04a806a5c4218cb703cba85d3e636d0c8cbae043

SHA256
1624a759791e49ce8f79dd249d3ac2aede589ffbe53db342e4c99e2fbbc1b90e

SHA512
29cad49434172a910ba7635058ecc02aacf43f648ee98b2c47c561332403a96847b5da817358095f7638295b238de8874bf34fb393670096bbf3caeb388a9c45

Download Submit
C:\Users\Admin\AppData\Local\Temp\8C8C.exe

Filesize
412KB

MD5
5200fbe07521eb001f145afb95d40283

SHA1
df6cfdf15b58a0bb24255b3902886dc375f3346f

SHA256
00c3f29f9a8aec0774256501c562275e2d866f0130a2b8a58d74003c6c77e812

SHA512
c38359959ce1083f94d2206d1b4b317e8c5d493168013b4e8c406acb5a55fd4f85ec7ce4d5e400b9105fd82eae3d6301d52346f040a64c09981185c66f2cbf75

Download Submit
C:\Users\Admin\AppData\Local\Temp\8C8C.exe

Filesize
412KB

MD5
5200fbe07521eb001f145afb95d40283

SHA1
df6cfdf15b58a0bb24255b3902886dc375f3346f

SHA256
00c3f29f9a8aec0774256501c562275e2d866f0130a2b8a58d74003c6c77e812

SHA512
c38359959ce1083f94d2206d1b4b317e8c5d493168013b4e8c406acb5a55fd4f85ec7ce4d5e400b9105fd82eae3d6301d52346f040a64c09981185c66f2cbf75

Download Submit
C:\Users\Admin\AppData\Local\Temp\945D.exe

Filesize
2.7MB

MD5
e970b798726fa0f843b721b114092d36

SHA1
1eb26039458e8efa25f79e0761c326c46d0a2399

SHA256
1e64119a33841abfab9164f88829d828fd3545bc2b017159ab82d7adf621701f

SHA512
65b482972f9e6b177186b6d15f6f7ce183a072633d6b5170b2202ddf0a1ba53a4a1a4dd14430c368ac9573e8435b1f625f898c6f7fd1e82e5e7e5075a859872e

Download Submit
C:\Users\Admin\AppData\Local\Temp\945D.exe

Filesize
2.7MB

MD5
e970b798726fa0f843b721b114092d36

SHA1
1eb26039458e8efa25f79e0761c326c46d0a2399

SHA256
1e64119a33841abfab9164f88829d828fd3545bc2b017159ab82d7adf621701f

SHA512
65b482972f9e6b177186b6d15f6f7ce183a072633d6b5170b2202ddf0a1ba53a4a1a4dd14430c368ac9573e8435b1f625f898c6f7fd1e82e5e7e5075a859872e

Download Submit
C:\Users\Admin\AppData\Local\Temp\96DF.exe

Filesize
298KB

MD5
8bd874c0500c7112d04cfad6fda75524

SHA1
d04a20e3bb7ffe5663f69c870457ad4edeb00192

SHA256
22aa36bd2f8ace8d959f22cf0e99bfe1d3fd655c075aa14a3232fb9e0f35adc2

SHA512
d6c43d5a5d1bfca1dddfb6283eafcd1f274e52812ccfee877298dfc74930fe6a8ec7035f95107600742ef19a630bee3ca3fab1fc7ab3ff717bea8f8c05e384d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\96DF.exe

Filesize
298KB

MD5
8bd874c0500c7112d04cfad6fda75524

SHA1
d04a20e3bb7ffe5663f69c870457ad4edeb00192

SHA256
22aa36bd2f8ace8d959f22cf0e99bfe1d3fd655c075aa14a3232fb9e0f35adc2

SHA512
d6c43d5a5d1bfca1dddfb6283eafcd1f274e52812ccfee877298dfc74930fe6a8ec7035f95107600742ef19a630bee3ca3fab1fc7ab3ff717bea8f8c05e384d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\9896.bat

Filesize
79B

MD5
403991c4d18ac84521ba17f264fa79f2

SHA1
850cc068de0963854b0fe8f485d951072474fd45

SHA256
ef6e942aefe925fefac19fa816986ea25de6935c4f377c717e29b94e65f9019f

SHA512
a20aaa77065d30195e5893f2ff989979383c8d7f82d9e528d4833b1c1236aef4f85284f5250d0f190a174790b650280ffe1fbff7e00c98024ccf5ca746e5b576

Download Submit
C:\Users\Admin\AppData\Local\Temp\OHGqPJ.O0Z

Filesize
2.6MB

MD5
865220f63ee10af1a67a8fdf9f7ea350

SHA1
5dd7f39d146249a4fb36d4e9a3a4c49dd182dc6a

SHA256
18e6590ca49ae72315f2ab9275da52481323177b115914b53cde88b2d31500ce

SHA512
9f10888fd254021c9f43bfbf127c40e510f575a11c5976612e64d878a2f925f78b23ab69714c0d593ad79bd894f5defa03023b071f3328ebe0fc17a71cc461ae

Download Submit
C:\Users\Admin\AppData\Roaming\gsgurcs

Filesize
96KB

MD5
7825cad99621dd288da81d8d8ae13cf5

SHA1
f3e1ab0c8e4f22e718cdeb6fa5faa87b0e61e73c

SHA256
529088553fe9cb3e497ef704ce9bc7bc07630f6ddfad44afb92acfe639789ec5

SHA512
2e81251a2c140a96f681fa95d82eee531b391e2654daa90da08d1dd00f13cba949136d465a2dc37507d40b4a708b6fc695baa716f19737591b1a89bd2a4b60b4

Download Submit
C:\Users\Admin\AppData\Roaming\gsgurcs

Filesize
96KB

MD5
7825cad99621dd288da81d8d8ae13cf5

SHA1
f3e1ab0c8e4f22e718cdeb6fa5faa87b0e61e73c

SHA256
529088553fe9cb3e497ef704ce9bc7bc07630f6ddfad44afb92acfe639789ec5

SHA512
2e81251a2c140a96f681fa95d82eee531b391e2654daa90da08d1dd00f13cba949136d465a2dc37507d40b4a708b6fc695baa716f19737591b1a89bd2a4b60b4

Download Submit
\Users\Admin\AppData\Local\Temp\OHGqpJ.O0z

Filesize
2.6MB

MD5
865220f63ee10af1a67a8fdf9f7ea350

SHA1
5dd7f39d146249a4fb36d4e9a3a4c49dd182dc6a

SHA256
18e6590ca49ae72315f2ab9275da52481323177b115914b53cde88b2d31500ce

SHA512
9f10888fd254021c9f43bfbf127c40e510f575a11c5976612e64d878a2f925f78b23ab69714c0d593ad79bd894f5defa03023b071f3328ebe0fc17a71cc461ae

Download Submit
memory/1488-109-0x0000000009DF0000-0x0000000009FB2000-memory.dmp

Filesize
1.8MB

Download
memory/1488-26-0x0000000007C60000-0x0000000007C70000-memory.dmp

Filesize
64KB

Download
memory/1488-28-0x0000000008A50000-0x0000000009056000-memory.dmp

Filesize
6.0MB

Download
memory/1488-46-0x00000000084F0000-0x0000000008556000-memory.dmp

Filesize
408KB

Download
memory/1488-31-0x0000000007CC0000-0x0000000007CFE000-memory.dmp

Filesize
248KB

Download
memory/1488-30-0x0000000007D80000-0x0000000007E8A000-memory.dmp

Filesize
1.0MB

Download
memory/1488-29-0x0000000007C40000-0x0000000007C52000-memory.dmp

Filesize
72KB

Download
memory/1488-27-0x00000000056A0000-0x00000000056AA000-memory.dmp

Filesize
40KB

Download
memory/1488-240-0x00000000730C0000-0x00000000737AE000-memory.dmp

Filesize
6.9MB

Download
memory/1488-111-0x0000000009CD0000-0x0000000009CEE000-memory.dmp

Filesize
120KB

Download
memory/1488-126-0x0000000007C60000-0x0000000007C70000-memory.dmp

Filesize
64KB

Download
memory/1488-25-0x0000000007AE0000-0x0000000007B72000-memory.dmp

Filesize
584KB

Download
memory/1488-24-0x0000000007F40000-0x000000000843E000-memory.dmp

Filesize
5.0MB

Download
memory/1488-116-0x00000000730C0000-0x00000000737AE000-memory.dmp

Filesize
6.9MB

Download
memory/1488-32-0x0000000007D20000-0x0000000007D6B000-memory.dmp

Filesize
300KB

Download
memory/1488-20-0x0000000000CA0000-0x0000000000CFA000-memory.dmp

Filesize
360KB

Download
memory/1488-108-0x0000000009BA0000-0x0000000009C16000-memory.dmp

Filesize
472KB

Download
memory/1488-21-0x00000000730C0000-0x00000000737AE000-memory.dmp

Filesize
6.9MB

Download
memory/1488-110-0x000000000A4F0000-0x000000000AA1C000-memory.dmp

Filesize
5.2MB

Download
memory/2288-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2288-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2288-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2848-129-0x00000000037B0000-0x00000000038E1000-memory.dmp

Filesize
1.2MB

Download
memory/2848-43-0x00007FF6B3C90000-0x00007FF6B3CDE000-memory.dmp

Filesize
312KB

Download
memory/2848-518-0x00000000037B0000-0x00000000038E1000-memory.dmp

Filesize
1.2MB

Download
memory/2848-128-0x0000000003630000-0x00000000037A1000-memory.dmp

Filesize
1.4MB

Download
memory/2924-62-0x0000000002F30000-0x0000000002F36000-memory.dmp

Filesize
24KB

Download
memory/2924-56-0x0000000001110000-0x0000000001140000-memory.dmp

Filesize
192KB

Download
memory/2924-61-0x00000000730C0000-0x00000000737AE000-memory.dmp

Filesize
6.9MB

Download
memory/2924-250-0x00000000730C0000-0x00000000737AE000-memory.dmp

Filesize
6.9MB

Download
memory/2924-406-0x000000000BF40000-0x000000000BF90000-memory.dmp

Filesize
320KB

Download
memory/2924-380-0x0000000002F40000-0x0000000002F50000-memory.dmp

Filesize
64KB

Download
memory/2924-447-0x00000000730C0000-0x00000000737AE000-memory.dmp

Filesize
6.9MB

Download
memory/2924-65-0x0000000002F40000-0x0000000002F50000-memory.dmp

Filesize
64KB

Download
memory/2960-87-0x0000016BF1E00000-0x0000016BF1E10000-memory.dmp

Filesize
64KB

Download
memory/2960-411-0x0000016BF85B0000-0x0000016BF85B1000-memory.dmp

Filesize
4KB

Download
memory/2960-413-0x0000016BF85C0000-0x0000016BF85C1000-memory.dmp

Filesize
4KB

Download
memory/2960-69-0x0000016BF1520000-0x0000016BF1530000-memory.dmp

Filesize
64KB

Download
memory/2960-107-0x0000016BF1860000-0x0000016BF1862000-memory.dmp

Filesize
8KB

Download
memory/3244-4-0x0000000000710000-0x0000000000726000-memory.dmp

Filesize
88KB

Download
memory/3728-127-0x0000000004B20000-0x0000000004C03000-memory.dmp

Filesize
908KB

Download
memory/3728-54-0x0000000000970000-0x0000000000976000-memory.dmp

Filesize
24KB

Download
memory/3728-53-0x0000000010000000-0x0000000010297000-memory.dmp

Filesize
2.6MB

Download
memory/3728-115-0x0000000004A20000-0x0000000004B1C000-memory.dmp

Filesize
1008KB

Download
memory/3728-117-0x0000000004B20000-0x0000000004C03000-memory.dmp

Filesize
908KB

Download
memory/3728-121-0x0000000004B20000-0x0000000004C03000-memory.dmp

Filesize
908KB

Download
memory/4280-419-0x00000166BDF30000-0x00000166BDF32000-memory.dmp

Filesize
8KB

Download
memory/4280-280-0x00000166BC7A0000-0x00000166BC7C0000-memory.dmp

Filesize
128KB

Download
memory/4280-468-0x00000166BDD00000-0x00000166BDE00000-memory.dmp

Filesize
1024KB

Download
memory/4280-385-0x00000166BDBC0000-0x00000166BDBC2000-memory.dmp

Filesize
8KB

Download
memory/4280-431-0x00000166BE6D0000-0x00000166BE6D2000-memory.dmp

Filesize
8KB

Download
memory/4280-428-0x00000166BE6C0000-0x00000166BE6C2000-memory.dmp

Filesize
8KB

Download
memory/4280-389-0x00000166BD700000-0x00000166BD800000-memory.dmp

Filesize
1024KB

Download
memory/4280-422-0x00000166BE170000-0x00000166BE172000-memory.dmp

Filesize
8KB

Download
memory/4280-398-0x00000166BDF80000-0x00000166BDF82000-memory.dmp

Filesize
8KB

Download
memory/4280-408-0x00000166BDED0000-0x00000166BDED2000-memory.dmp

Filesize
8KB

Download
memory/4280-394-0x00000166BDF60000-0x00000166BDF62000-memory.dmp

Filesize
8KB

Download