hxxps://workupload[.]com/file/zYQPSmgMkAj

Analysis

max time kernel
79s
max time network
86s
platform
windows10-1703_x64
resource
win10-20231020-ja
resource tags

arch:x64arch:x86image:win10-20231020-jalocale:ja-jpos:windows10-1703-x64systemwindows
submitted
06/11/2023, 16:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://workupload.com/file/zYQPSmgMkAj

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\OneTimeCleanup = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B72164 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CTLs	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = f46935e1d110da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "395205405"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = 010000000304a45fbb5e547e8dea800a0473b2deb355a8239f39174de8e908f10cc5e848ab6fda48c0bb417a73f3863a198ed346b9b79046425f08e6625f	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = fb23f9fbd110da01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\FileVersion = "2016061511"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\NextBrowserDataLogTime = f0a85c460411da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 15c7e2f4d110da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CRLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 325902e7d110da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$http://www.typepad.com/	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "395205405"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames\	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\NextUpdateDate = "406138780"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$MediaWiki	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\NextPromptBuild = "15063"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage\ProcessingFlag = 60d4d6f4d110da01	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$Telligent	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = eb572fead110da01	MicrosoftEdge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\AltGenV1.exe.qiiyibm.partial:Zone.Identifier	browser_broker.exe
File opened for modification	C:\Users\Admin\Downloads\AltGenV1.exe.k8fcrjs.partial:Zone.Identifier	browser_broker.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
4332	MicrosoftEdgeCP.exe
4332	MicrosoftEdgeCP.exe
4332	MicrosoftEdgeCP.exe
4332	MicrosoftEdgeCP.exe
4332	MicrosoftEdgeCP.exe
4332	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	600	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	600	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	600	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	600	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2896	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2896	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	192	MicrosoftEdge.exe
Token: SeDebugPrivilege	192	MicrosoftEdge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
192	MicrosoftEdge.exe
4332	MicrosoftEdgeCP.exe
600	MicrosoftEdgeCP.exe
4332	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4332 wrote to memory of 4692	4332	MicrosoftEdgeCP.exe	76
PID 4332 wrote to memory of 4692	4332	MicrosoftEdgeCP.exe	76
PID 4332 wrote to memory of 4692	4332	MicrosoftEdgeCP.exe	76
PID 4332 wrote to memory of 4692	4332	MicrosoftEdgeCP.exe	76
PID 4332 wrote to memory of 4692	4332	MicrosoftEdgeCP.exe	76
PID 4332 wrote to memory of 4692	4332	MicrosoftEdgeCP.exe	76
PID 4332 wrote to memory of 4692	4332	MicrosoftEdgeCP.exe	76
PID 4332 wrote to memory of 4692	4332	MicrosoftEdgeCP.exe	76
PID 4332 wrote to memory of 4692	4332	MicrosoftEdgeCP.exe	76
PID 4332 wrote to memory of 4692	4332	MicrosoftEdgeCP.exe	76
PID 4332 wrote to memory of 4692	4332	MicrosoftEdgeCP.exe	76
PID 4332 wrote to memory of 4692	4332	MicrosoftEdgeCP.exe	76
PID 4332 wrote to memory of 4692	4332	MicrosoftEdgeCP.exe	76
PID 4332 wrote to memory of 4692	4332	MicrosoftEdgeCP.exe	76
PID 4332 wrote to memory of 4692	4332	MicrosoftEdgeCP.exe	76
PID 4332 wrote to memory of 4692	4332	MicrosoftEdgeCP.exe	76
PID 4332 wrote to memory of 4692	4332	MicrosoftEdgeCP.exe	76
PID 4332 wrote to memory of 4692	4332	MicrosoftEdgeCP.exe	76
PID 4332 wrote to memory of 4692	4332	MicrosoftEdgeCP.exe	76
PID 4332 wrote to memory of 3716	4332	MicrosoftEdgeCP.exe	81
PID 4332 wrote to memory of 3716	4332	MicrosoftEdgeCP.exe	81
PID 4332 wrote to memory of 3716	4332	MicrosoftEdgeCP.exe	81
PID 4332 wrote to memory of 348	4332	MicrosoftEdgeCP.exe	83
PID 4332 wrote to memory of 348	4332	MicrosoftEdgeCP.exe	83
PID 4332 wrote to memory of 348	4332	MicrosoftEdgeCP.exe	83

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\LaunchWinApp.exe
"C:\Windows\system32\LaunchWinApp.exe" "https://workupload.com/file/zYQPSmgMkAj"
1⤵
PID:2088

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:192

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
- NTFS ADS
PID:3532

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4332

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:600

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4692

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2896

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1528

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:3716

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4208

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
4KB

MD5
1bfe591a4fe3d91b03cdf26eaacd8f89

SHA1
719c37c320f518ac168c86723724891950911cea

SHA256
9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8

SHA512
02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

Download Submit
C:\Users\Admin\AppData\Local\MicrosoftEdge\SharedCacheContainers\MicrosoftEdge_iecompat\IECompatData.xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\H9USJ473\fontawesome-webfont[1].woff2

Filesize
75KB

MD5
af7ae505a9eed503f8b8e6982036873e

SHA1
d6f48cba7d076fb6f2fd6ba993a75b9dc1ecbf0c

SHA256
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

SHA512
838fefdbc14901f41edf995a78fdac55764cd4912ccb734b8bea4909194582904d8f2afdf2b6c428667912ce4d65681a1044d045d1bc6de2b14113f0315fc892

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\H9USJ473\roboto-v29-vietnamese_latin-ext_latin_greek-ext_greek_cyrillic-ext_cyrillic-300[1].woff2

Filesize
48KB

MD5
cb360a9e4e7b13ce18ddf311ba981d3f

SHA1
47a93c49a21e5b7a95614509e4617256a67cd09c

SHA256
ad885c9ecffe5091fae72b5ea3842772f1f3101ef5a34257125c432c7b32c1e5

SHA512
56d701587d1f490eea1db0211bad82943f3030eed759c87193028283a74d9b9e92b08abd131e78316d3c76a8352ba9c01e29084e8f02fbdcdaf316f81a51c04a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\H9USJ473\roboto-v29-vietnamese_latin-ext_latin_greek-ext_greek_cyrillic-ext_cyrillic-300italic[1].woff2

Filesize
53KB

MD5
105c4517647a5cf946c89574f4acd9c6

SHA1
e044d5ef0e5ea23c954e70b8de8482e01e087cfe

SHA256
1c76a1843b4841f5a663c4c11a77d38c636b77577f8b6bee0d51b7fa21820fce

SHA512
48e39107e14fc0cbff40dbfe94fd6981816c467305ed0ea4995a8c9d6fc051b95f50b68ebfa38ec8b6aa2e2247e2b9bfd556e01711714807c27a977567f45cb7

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\H9USJ473\roboto-v29-vietnamese_latin-ext_latin_greek-ext_greek_cyrillic-ext_cyrillic-500[1].woff2

Filesize
49KB

MD5
e49eef23dfc0f7c54977c365624b68fa

SHA1
9f513cb4d813a9ffebc3d87181f5dd5aba3dfa9b

SHA256
ee7e4a24daafdb8c937da249dc9bf3786eb966f53cbcb436a950e49298e8da75

SHA512
c97278efe5a306e12507c1cd8e9d8704469b37e64c485187bed9a855693f6ce5306e6d9165d64d0f820f9849c01815f8e78b72e90ab294a5274453e96b772cdc

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\H9USJ473\roboto-v29-vietnamese_latin-ext_latin_greek-ext_greek_cyrillic-ext_cyrillic-700[1].woff2

Filesize
49KB

MD5
bc4866b032d34d1ab1fe7d30fe7d2af2

SHA1
98fe0e5e6e425a6881de5971eae18cd5ccb5ccf7

SHA256
be54ac8b9843afcd92dea7b3e72306efec71ba3b6365f679f179c7ca4a0aea9f

SHA512
200a3da2976be7fe5e4330f8f4444fcbf63f6ead8940a82eb47415993ee07b5447ed52634f1563b603c19acf39196faaac4a54b7cd6b058ba1ae2cff85a206a7

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\H9USJ473\roboto-v29-vietnamese_latin-ext_latin_greek-ext_greek_cyrillic-ext_cyrillic-regular[1].woff2

Filesize
49KB

MD5
184a2a669cf798f8d80bcfba041c3ecf

SHA1
b8dbbf83b27b5e4f5588f997685b2ccfecf97ff6

SHA256
659a8dee04b272c247129ff6513d23c16f4f9c183b5d64e7347815af8861a2a4

SHA512
c882dfc93fe0b07584a21a24b9e89ef8b3b6ce3e07d3f1b822f750a18aff353997cddf11c711aefe90861787068d7e281d23c8cfd5299b883122ad74f3dfa8ec

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\YYYEZRR2\39b9ad5[1].js

Filesize
356KB

MD5
6cb99a6f427546895e74ec1350e69179

SHA1
9db3af6d6fcbcb7426b43e43900b06a45b0a89eb

SHA256
67159dc40cc215b30f27b9639cf796d6f76aed748a0dd084890c087d8b20f8e1

SHA512
fa1e1713cd18246d441327f804ef4abab543f9ab18b6f12a1cd61acf8a06b51555719ff886b87b4679b5f94e1b63801b1749f0a0d69bb5e6b7601c518de05bf7

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\YYYEZRR2\4280ebd[1].css

Filesize
208KB

MD5
a7a1d818796d169827c6cd4b27526f1e

SHA1
a82f7eeb699d49b1d33faeee937f5a67f6c1a920

SHA256
57389cc10d18821773ef1370537a0f3c3deaba592ba9c50c22b4dafe2c2204d1

SHA512
8e4d18e9116da8a3768236e30b8c0a4d35c31affc9a942fcc6b119aca1b19759cd77850d1f373cda2bc221f5f3cb5408e30ab866f41e711141a9059c748c4941

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\YYYEZRR2\translations[1].js

Filesize
57KB

MD5
495aed366eb40bcb47ab9f15924071a4

SHA1
f024153912fb954e63c709468b1171a23bc0e44c

SHA256
1bf83bc3b31c3fe695168f1e0fbd2aca07db1018894cdc703aea8cb61d3a34cf

SHA512
4d4f29abeba4febc1f36d8cacacc69a3cac063a01613dccc4646f85e0724a8553302689d293ab98b2efa26aa1b7ed94821188757272db5e3274ff467b4eedb67

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\4UWJFR5I\suggestions[1].ja-JP

Filesize
17KB

MD5
f0e8351230b562572b4b315a1a55004f

SHA1
1cc73361100ce15353f2571a03a5d5a364be87d2

SHA256
650de9892142b102c0cd1f9deca25f93d83c0bb8b5434580c77dd4214a82e1a5

SHA512
3d7dd1a72a000041fe308828c714ac48c463e0022cad3495296d0eb72a0fc85127b3c46cdc0015da25d41e9d22eba887980c301663f37ad86e7ccbc452934d46

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\UDQGL5NF\favicon-32x32[1].png

Filesize
1KB

MD5
efaa2f41c9c29f4a99c8f078ab067cd5

SHA1
7fe61c1aa06995c4a2352b286f16c012bdcf7cfd

SHA256
1bb6e8d81cb1ae418b7191b9b74ad8f350641a5d5b6ed1a4d9a093e4a94f4f60

SHA512
ab73a2c14958c1401315e8457d47a60ab2ec19ec33afbd202d9985ac6aa2e043fac0101bf50ea555c193bc60a818036017ece0327a9bf81d9d439e566444f2d8

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\AltGenV1.exe

Filesize
7.3MB

MD5
88d3460373417959614ea3645c92cac2

SHA1
7da079eb981e8c09ca515b83c47126c259298ecf

SHA256
6c62c986537d32a006d482bee6d2fa4a55d8b644031cc6c1ab7981be41547961

SHA512
5a4aadbc647e933dd0ecad632d47767d254c994164613f5616d6422d0253a2a7a0c1e99ff36a42653e8b66041e2465f92637ad76461b844f6dbde576156ebf90

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\AltGenV1.exe.qiiyibm.partial

Filesize
7.3MB

MD5
88d3460373417959614ea3645c92cac2

SHA1
7da079eb981e8c09ca515b83c47126c259298ecf

SHA256
6c62c986537d32a006d482bee6d2fa4a55d8b644031cc6c1ab7981be41547961

SHA512
5a4aadbc647e933dd0ecad632d47767d254c994164613f5616d6422d0253a2a7a0c1e99ff36a42653e8b66041e2465f92637ad76461b844f6dbde576156ebf90

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ZJSKE6EH\AltGenV1[1].exe

Filesize
48KB

MD5
4be3f5335076349115bbaa48bddc240c

SHA1
d46198ff7d9b62d8fb6f295c732a659d57293ff0

SHA256
142f68e90b8fc8e466dfe129dbf4b6f3efdfa6fb8c0050c04813acdc330069b7

SHA512
1a418ab8f6ea7401b72e4643ecf71982fe959aa7d57dcef0af912b3a82b814b984d04d7159fd3c31f3096ddb92358178539ecc670a91c5fc656b3ae4e6c7422f

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ZJSKE6EH\AltGenV1[1].exe

Filesize
7.3MB

MD5
2fef21b5179873a916939c93ca95cb5a

SHA1
dec23d7e1f9c8a9e9b851b99b06f40b0fd32bcbc

SHA256
3cb6498528ecd266b860af4a015c4ba7d1db09174b356401ff1eb9638eb42f6d

SHA512
f66d1aef30bf568cb638ef5798e25bc4f8306dc67670397df7fca5cfbce9d7232929c8746a37c923ac9c4a67194434f9168c916d0b6508a96823c83939cd0926

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

Filesize
717B

MD5
60fe01df86be2e5331b0cdbe86165686

SHA1
2a79f9713c3f192862ff80508062e64e8e0b29bd

SHA256
c08ccbc876cd5a7cdfa9670f9637da57f6a1282198a9bc71fc7d7247a6e5b7a8

SHA512
ef9f9a4dedcbfe339f4f3d07fb614645596c6f2b15608bdccdad492578b735f7cb075bdaa07178c764582ee345857ec4665f90342694e6a60786bb3d9b3a3d23

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\97A23E270F9B7348A3668690534AB3C1

Filesize
503B

MD5
66c82699c6f6e0d61eab2fef7a175594

SHA1
83037b574bf2b7017400ae50816c0792e4e3833c

SHA256
1398c8db43a4591138a48021056356598a83917cf68c675e2d24655f8140f677

SHA512
87c4c37739c1644c4572260cb61b7e69d2a5616c28e2a73a369265b5accb05fa70fa72a473103b51cc1f02d2412512c680f6d79ad5d7ae69e24ffdaafa2b43b9

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
8d6c1f00e533aa9eabd42dcb913f6353

SHA1
e8f03a96abcd685e23e5163db0fefa4d77ec1f8c

SHA256
284e5a1c82d3d2ad962c509b1bc2537fb50d8617506594b9307f58738f37f30a

SHA512
41b47044f7dc65963c167b5dd391214972489ef9bc00d158b7ce6d28f7d875dc29b6efeee9c29c07e7832413e4d7cf5879aa525e7bd54ef86ec125126e201bfc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\97A23E270F9B7348A3668690534AB3C1

Filesize
548B

MD5
b1c617fdf9fd7e76aba5f09fdc794e23

SHA1
7a0aef50d11f056e51888dedfc93f299471fcbb5

SHA256
447537691be38c17021de2ecc34b2c0891a65e78f9499aa9d64e5a541eb0599b

SHA512
809efae8c3d2b30cc7c8e1f904acb67328ebfbdd860ebf0bc1c152e1bcf3e8022b5635be5354f98d2971bebc3ab9880709806d47b3bfeb5273dcbca88dc72ed1

Download Submit
C:\Users\Admin\Downloads\AltGenV1.exe.k8fcrjs.partial

Filesize
7.3MB

MD5
88d3460373417959614ea3645c92cac2

SHA1
7da079eb981e8c09ca515b83c47126c259298ecf

SHA256
6c62c986537d32a006d482bee6d2fa4a55d8b644031cc6c1ab7981be41547961

SHA512
5a4aadbc647e933dd0ecad632d47767d254c994164613f5616d6422d0253a2a7a0c1e99ff36a42653e8b66041e2465f92637ad76461b844f6dbde576156ebf90

Download Submit
memory/192-16-0x00000290CC780000-0x00000290CC790000-memory.dmp

Filesize
64KB

Download
memory/192-128-0x00000290D39F0000-0x00000290D39F1000-memory.dmp

Filesize
4KB

Download
memory/192-127-0x00000290D39E0000-0x00000290D39E1000-memory.dmp

Filesize
4KB

Download
memory/192-35-0x00000290CC3F0000-0x00000290CC3F2000-memory.dmp

Filesize
8KB

Download
memory/192-0-0x00000290CBE20000-0x00000290CBE30000-memory.dmp

Filesize
64KB

Download
memory/4692-196-0x00000224B5B80000-0x00000224B5C80000-memory.dmp

Filesize
1024KB

Download
memory/4692-108-0x00000224B3DF0000-0x00000224B3DF2000-memory.dmp

Filesize
8KB

Download
memory/4692-102-0x00000224B3DA0000-0x00000224B3DA2000-memory.dmp

Filesize
8KB

Download
memory/4692-104-0x00000224B3DC0000-0x00000224B3DC2000-memory.dmp

Filesize
8KB

Download
memory/4692-66-0x00000224B2480000-0x00000224B2482000-memory.dmp

Filesize
8KB

Download
memory/4692-63-0x00000224B2450000-0x00000224B2452000-memory.dmp

Filesize
8KB

Download
memory/4692-106-0x00000224B3DD0000-0x00000224B3DD2000-memory.dmp

Filesize
8KB

Download
memory/4692-71-0x00000224B24D0000-0x00000224B24D2000-memory.dmp

Filesize
8KB

Download
memory/4692-114-0x00000224B5560000-0x00000224B5562000-memory.dmp

Filesize
8KB

Download
memory/4692-137-0x00000224B2BB0000-0x00000224B2BB2000-memory.dmp

Filesize
8KB

Download
memory/4692-134-0x00000224B2B50000-0x00000224B2B52000-memory.dmp

Filesize
8KB

Download
memory/4692-187-0x00000224B2D40000-0x00000224B2E40000-memory.dmp

Filesize
1024KB

Download
memory/4692-144-0x00000224B2C10000-0x00000224B2C12000-memory.dmp

Filesize
8KB

Download
memory/4692-141-0x00000224B2C00000-0x00000224B2C02000-memory.dmp

Filesize
8KB

Download