mystic | 084c98a06d49a19a4412caaf3a224b2083f1a52f28a5a891dc4fb91760bed303

Analysis

max time kernel
7s
max time network
307s
platform
windows10-1703_x64
resource
win10-20231020-en
resource tags

arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system
submitted
12-11-2023 22:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

084c98a06d49a19a4412caaf3a224b2083f1a52f28a5a891dc4fb91760bed303.exe
Size

1.3MB
MD5

2e9a2497666c4958ed906e7cae0ac52d
SHA1

f0a76ba69d2c80637cea4aac6f260152ca0b8884
SHA256

084c98a06d49a19a4412caaf3a224b2083f1a52f28a5a891dc4fb91760bed303
SHA512

8140d0357e97b494a0244903c2e6b7d6745e201b5e6331fd6e6dc6774726069222f0124d8e9185a2980859f415b4ce44530d70c438d227000ec527a4874ea25a
SSDEEP

24576:my2rDJsp38kgaeAIs1ClGZg1DPWOVPmsSWFg0hqL1dTvZn:12rtsFL5eHk4GOLWnWi04T

Score

10^/10

mystic redline taiga google infostealer persistence phishing stealer

Malware Config

Extracted

Family

redline

Botnet

taiga

5.42.92.51:19057

Signatures

Detect Mystic stealer payload 4 IoCs

resource	yara_rule
behavioral2/memory/3800-77-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/3800-81-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/3800-78-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/3800-74-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Detected google phishing page
phishing google
Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/5028-86-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000\Control Panel\International\Geo\Nation	10ZK42zz.exe

Executes dropped EXE 6 IoCs

pid	Process
4988	Jw9Xw49.exe
1332	uB6hG11.exe
4588	10ZK42zz.exe
4860	11EU9903.exe
1060	12Dn078.exe
788	13uw990.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	084c98a06d49a19a4412caaf3a224b2083f1a52f28a5a891dc4fb91760bed303.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	Jw9Xw49.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	uB6hG11.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000700000001ab80-20.dat	autoit_exe
behavioral2/files/0x000700000001ab80-19.dat	autoit_exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4860 set thread context of 3800	4860	11EU9903.exe	84
PID 1060 set thread context of 5028	1060	12Dn078.exe	90
PID 788 set thread context of 1572	788	13uw990.exe	94

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5012	3800	WerFault.exe	84

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{9F70FF52-80C9-4711-95BB-B33CE8BF149B} = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B72164 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = f4c0711eb615da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-087602 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 39ac4220b615da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1384	MicrosoftEdgeCP.exe
1384	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3440	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3440	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3440	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3440	MicrosoftEdgeCP.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
4588	10ZK42zz.exe
4588	10ZK42zz.exe
4588	10ZK42zz.exe
4588	10ZK42zz.exe
4588	10ZK42zz.exe
4588	10ZK42zz.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
4588	10ZK42zz.exe
4588	10ZK42zz.exe
4588	10ZK42zz.exe
4588	10ZK42zz.exe
4588	10ZK42zz.exe
4588	10ZK42zz.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1984	MicrosoftEdge.exe
1384	MicrosoftEdgeCP.exe
3440	MicrosoftEdgeCP.exe
1384	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 4988	4812	084c98a06d49a19a4412caaf3a224b2083f1a52f28a5a891dc4fb91760bed303.exe	21
PID 4812 wrote to memory of 4988	4812	084c98a06d49a19a4412caaf3a224b2083f1a52f28a5a891dc4fb91760bed303.exe	21
PID 4812 wrote to memory of 4988	4812	084c98a06d49a19a4412caaf3a224b2083f1a52f28a5a891dc4fb91760bed303.exe	21
PID 4988 wrote to memory of 1332	4988	Jw9Xw49.exe	20
PID 4988 wrote to memory of 1332	4988	Jw9Xw49.exe	20
PID 4988 wrote to memory of 1332	4988	Jw9Xw49.exe	20
PID 1332 wrote to memory of 4588	1332	uB6hG11.exe	22
PID 1332 wrote to memory of 4588	1332	uB6hG11.exe	22
PID 1332 wrote to memory of 4588	1332	uB6hG11.exe	22
PID 1332 wrote to memory of 4860	1332	uB6hG11.exe	81
PID 1332 wrote to memory of 4860	1332	uB6hG11.exe	81
PID 1332 wrote to memory of 4860	1332	uB6hG11.exe	81
PID 4860 wrote to memory of 3800	4860	11EU9903.exe	84
PID 4860 wrote to memory of 3800	4860	11EU9903.exe	84
PID 4860 wrote to memory of 3800	4860	11EU9903.exe	84
PID 4860 wrote to memory of 3800	4860	11EU9903.exe	84
PID 4860 wrote to memory of 3800	4860	11EU9903.exe	84
PID 4860 wrote to memory of 3800	4860	11EU9903.exe	84
PID 4860 wrote to memory of 3800	4860	11EU9903.exe	84
PID 4860 wrote to memory of 3800	4860	11EU9903.exe	84
PID 4860 wrote to memory of 3800	4860	11EU9903.exe	84
PID 4860 wrote to memory of 3800	4860	11EU9903.exe	84
PID 4988 wrote to memory of 1060	4988	Jw9Xw49.exe	88
PID 4988 wrote to memory of 1060	4988	Jw9Xw49.exe	88
PID 4988 wrote to memory of 1060	4988	Jw9Xw49.exe	88
PID 1060 wrote to memory of 832	1060	12Dn078.exe	93
PID 1060 wrote to memory of 832	1060	12Dn078.exe	93
PID 1060 wrote to memory of 832	1060	12Dn078.exe	93
PID 1060 wrote to memory of 5028	1060	12Dn078.exe	90
PID 1060 wrote to memory of 5028	1060	12Dn078.exe	90
PID 1060 wrote to memory of 5028	1060	12Dn078.exe	90
PID 1060 wrote to memory of 5028	1060	12Dn078.exe	90
PID 1060 wrote to memory of 5028	1060	12Dn078.exe	90
PID 1060 wrote to memory of 5028	1060	12Dn078.exe	90
PID 1060 wrote to memory of 5028	1060	12Dn078.exe	90
PID 1060 wrote to memory of 5028	1060	12Dn078.exe	90
PID 4812 wrote to memory of 788	4812	084c98a06d49a19a4412caaf3a224b2083f1a52f28a5a891dc4fb91760bed303.exe	92
PID 4812 wrote to memory of 788	4812	084c98a06d49a19a4412caaf3a224b2083f1a52f28a5a891dc4fb91760bed303.exe	92
PID 4812 wrote to memory of 788	4812	084c98a06d49a19a4412caaf3a224b2083f1a52f28a5a891dc4fb91760bed303.exe	92
PID 788 wrote to memory of 1572	788	13uw990.exe	94
PID 788 wrote to memory of 1572	788	13uw990.exe	94
PID 788 wrote to memory of 1572	788	13uw990.exe	94
PID 788 wrote to memory of 1572	788	13uw990.exe	94
PID 788 wrote to memory of 1572	788	13uw990.exe	94
PID 788 wrote to memory of 1572	788	13uw990.exe	94
PID 788 wrote to memory of 1572	788	13uw990.exe	94
PID 788 wrote to memory of 1572	788	13uw990.exe	94
PID 788 wrote to memory of 1572	788	13uw990.exe	94

C:\Users\Admin\AppData\Local\Temp\084c98a06d49a19a4412caaf3a224b2083f1a52f28a5a891dc4fb91760bed303.exe
"C:\Users\Admin\AppData\Local\Temp\084c98a06d49a19a4412caaf3a224b2083f1a52f28a5a891dc4fb91760bed303.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Jw9Xw49.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Jw9Xw49.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4988
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\12Dn078.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\12Dn078.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1060
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:5028
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:832
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\13uw990.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\13uw990.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:788
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:1572

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\uB6hG11.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\uB6hG11.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1332
- C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\10ZK42zz.exe
  C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\10ZK42zz.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4588
- C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\11EU9903.exe
  C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\11EU9903.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4860
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:3800
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3800 -s 568
      4⤵
      Program crash
      PID:5012

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1984

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:956

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:1384

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3440

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:3788

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:1492

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4840

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:5076

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4204

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4768

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:1780

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:2172

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:5284

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:5512

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:6224

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:6760

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:6060

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:3664

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:7084

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:1700

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:5864

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:3992

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:6032

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:5464

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:6604

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:6540

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:6576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DXEYB732\edgecompatviewlist[1].xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\EJVOUSH4\shared_global[1].css

Filesize
84KB

MD5
cfe7fa6a2ad194f507186543399b1e39

SHA1
48668b5c4656127dbd62b8b16aa763029128a90c

SHA256
723131aba2cf0edd34a29d63af1d7b4ff515b9a3a3e164b2493026132dd37909

SHA512
5c85bb6404d5be1871b0b2e2d2c9053716354acd69c7acca73d8ce8bf8f21645ae11f788f78ef624444016cb722ecbd6213e771bda36717725f2b60f53688c6b

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\EJVOUSH4\shared_responsive[2].css

Filesize
18KB

MD5
2ab2918d06c27cd874de4857d3558626

SHA1
363be3b96ec2d4430f6d578168c68286cb54b465

SHA256
4afb3e37bfdd549cc16ef5321faf3f0a3bf6e84c79fc4408bc6f157280636453

SHA512
3af59e0b16ef9d39c2f1c5ccdbd5c9ea35bd78571fde1b5bf01e51a675d5554e03225a2d7c04ed67e22569e9f43b16788105a0bf591ebba28ef917c961cc59e2

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\H5LW58SA\chunk~9229560c0[1].css

Filesize
34KB

MD5
19a9c503e4f9eabd0eafd6773ab082c0

SHA1
d9b0ca3905ab9a0f9ea976d32a00abb7935d9913

SHA256
7ba0cc7d66172829eef8ff773c1e9c6e2fde3cfd82d9a89e1a71751957e47b0a

SHA512
0145582e8eb3adb98ad2dbc0b8e7a29c1d0525f0fd515fcf82eda7b4ce2f7f7f6aa0e81912aa98927e6d420ed110eb497c287a0ad483f8af067332920d4bde83

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\H5LW58SA\fb[1].js

Filesize
62KB

MD5
1280951b6ef5fc0d70ebb6a2c5be5f3a

SHA1
37c5915367722577bd8b68fd99a3bb32920f7698

SHA256
6984ea6c3c74dcbc9ffd623a70d5e9fc08366f1548529f4ee315b72ec1942955

SHA512
79ad5917d22633a9b9639eacb1c36e3a29b13c54f2c1e43e581fb5bf5cbd95bbb8f233b6472b363d43d0e99e71b0147fe3329e01ef97a734ff7aa2ae647071c3

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\H5LW58SA\hcaptcha[1].js

Filesize
325KB

MD5
c2a59891981a9fd9c791bbff1344df52

SHA1
1bd69409a50107057b5340656d1ecd6f5726841f

SHA256
6beec8b04234097105f5d7a88af9c27552b27021446c9dbe029d908d1ff8599f

SHA512
f9d556e0f7e95e603881c5196cc2aa736eb24ed62086d09d36a9e1d6b4fec9f4c1dfb125a66bec301f57230a4242108c7c255e6aa3c6f08a3a0d75e0cf288afe

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\H5LW58SA\recaptcha__en[1].js

Filesize
465KB

MD5
fbeedf13eeb71cbe02bc458db14b7539

SHA1
38ce3a321b003e0c89f8b2e00972caa26485a6e0

SHA256
09ed391c987b3b27df5080114e00377ff1a748793cb417a809b33f22d737fe55

SHA512
124b9f53a53ef596a54c6c04ab3be2b25d33d1ce915978ec03da8f9f294db91d41ee9091b722e462722f51f9d9455ce480e1a0cb57c2f3248c7a3a9e3b9dac58

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\K57O7PDP\buttons[1].css

Filesize
32KB

MD5
b91ff88510ff1d496714c07ea3f1ea20

SHA1
9c4b0ad541328d67a8cde137df3875d824891e41

SHA256
0be99fd30134de50d457729cebd0e08342777af747caf503108178cb4c375085

SHA512
e82438186bfc3e9ca690af8e099aafbfbc71c9310f9d1c8cb87ffa9e7f0f11f33982c63a2dac95c9b83fef1aaa59178b73212fc76e895d13a1ffbbe3c1adfa4c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\K57O7PDP\shared_global[1].js

Filesize
149KB

MD5
f94199f679db999550a5771140bfad4b

SHA1
10e3647f07ef0b90e64e1863dd8e45976ba160c0

SHA256
26c013d87a0650ece1f28cdc42d7995ad1a57e5681e30c4fd1c3010d995b7548

SHA512
66aef2dda0d8b76b68fd4a90c0c8332d98fe6d23590954a20317b0129a39feb9cd3bd44e0c57e6b309227d912c6c07b399302a5e680615e05269769b7e750036

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\K57O7PDP\tooltip[1].js

Filesize
15KB

MD5
72938851e7c2ef7b63299eba0c6752cb

SHA1
b75196bd3a6f9f4dfc1bbf5e43e96874bcd9ce4e

SHA256
e2d4e0e1d3e162fdc815f16dfff9ae9b0a967949f0f3ae371f947d730a3f0661

SHA512
2bb6c03a1335ef9514d0d172a4284d82a29d1783a72306bdcb8af3185d5cd2ff16303355aa4b05086d2fa0b5b7c7159cfa67de4a6175095ff0e68adec2a56ac1

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\MPDWC1BC\shared_responsive_adapter[1].js

Filesize
24KB

MD5
a52bc800ab6e9df5a05a5153eea29ffb

SHA1
8661643fcbc7498dd7317d100ec62d1c1c6886ff

SHA256
57cfaf9b92c98541f769090cd0229a30013cea7cfafc18519ca654bfae29e14e

SHA512
1bcacd0ec7c3d633d6296fff3325802d6352805f0d2cf1eea39237424229ecffad6cb2aee4248e28b1eca02ff0646b58240851a246bbcf0aa1083830d5d9081e

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\CW5K8CQ9\www.epicgames[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\T2E096T6\c.paypal[1].xml

Filesize
17B

MD5
3ff4d575d1d04c3b54f67a6310f2fc95

SHA1
1308937c1a46e6c331d5456bcd4b2182dc444040

SHA256
021a5868b6c9e8beba07848ba30586c693f87ac02ee2ccaa0f26b7163c0c6b44

SHA512
2b26501c4bf86ed66e941735c49ac445d683ad49ed94c5d87cc96228081ae2c8f4a8f44a2a5276b9f4b0962decfce6b9eeee38e42262ce8d865d5df0df7ec3d6

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
4KB

MD5
1bfe591a4fe3d91b03cdf26eaacd8f89

SHA1
719c37c320f518ac168c86723724891950911cea

SHA256
9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8

SHA512
02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\1NV6XEMV\B8BxsscfVBr[1].ico

Filesize
1KB

MD5
e508eca3eafcc1fc2d7f19bafb29e06b

SHA1
a62fc3c2a027870d99aedc241e7d5babba9a891f

SHA256
e6d1d77403cd9f14fd2377d07e84350cfe768e3353e402bf42ebdc8593a58c9a

SHA512
49e3f31fd73e52ba274db9c7d306cc188e09c3ae683827f420fbb17534d197a503460e7ec2f1af46065f8d0b33f37400659bfa2ae165e502f97a8150e184a38c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\1NV6XEMV\epic-favicon-96x96[1].png

Filesize
5KB

MD5
c94a0e93b5daa0eec052b89000774086

SHA1
cb4acc8cfedd95353aa8defde0a82b100ab27f72

SHA256
3f51f3fb508f0d0361b722345974969576daef2c7d3db8f97c4ca8e1ff1a1775

SHA512
f676705e63f89d76520637b788f3bac96d177d1be7f9762aeb8d5d1554afd7666cbd6ef22ce08f581eb59bd383dd1971896231264bc3eaabf21135c967930240

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\HKOHXP44\favicon[1].ico

Filesize
1KB

MD5
630d203cdeba06df4c0e289c8c8094f6

SHA1
eee14e8a36b0512c12ba26c0516b4553618dea36

SHA256
bbce71345828a27c5572637dbe88a3dd1e065266066600c8a841985588bf2902

SHA512
09f4e204960f4717848bf970ac4305f10201115e45dd5fe0196a6346628f0011e7bc17d73ec946b68731a5e179108fd39958cecf41125f44094f63fe5f2aeb2c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\HKOHXP44\pp_favicon_x[1].ico

Filesize
5KB

MD5
e1528b5176081f0ed963ec8397bc8fd3

SHA1
ff60afd001e924511e9b6f12c57b6bf26821fc1e

SHA256
1690c4e20869c3763b7fc111e2f94035b0a7ee830311dd680ac91421daad3667

SHA512
acf71864e2844907752901eeeaf5c5648d9f6acf3b73a2fb91e580bee67a04ffe83bc2c984a9464732123bc43a3594007691653271ba94f95f7e1179f4146212

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\HKOHXP44\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\R0NIR8WO\favicon[1].ico

Filesize
37KB

MD5
231913fdebabcbe65f4b0052372bde56

SHA1
553909d080e4f210b64dc73292f3a111d5a0781f

SHA256
9f890a9debcdfccc339149a7943be9aff9e4c9203c2fa37d5671a5b2c88503ad

SHA512
7b11b709968c5a52b9b60189fb534f5df56912417243820e9d1c00c97f4bd6d0835f2cdf574d0c36ecb32dbbf5fc397324df54f7fdf9e1b062b5dbda2c02e919

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\ImageStore\7vl9yki\imagestore.dat

Filesize
31KB

MD5
b63c40ac09bcd7dc8845d5b242c977aa

SHA1
e19d82644d20b8e92eef7e8a5b439781aadf0ad2

SHA256
df487ee632d68ec10ba7b07f45145e55d0302f6cf9828097ee96c17174c92c04

SHA512
67ba755bd415a5839ebe7a08477f51e118ff32f160e264b4fce29e8f6da5e5f69cf597525243e0fe19367bbcb7d19421316d20575feb0cd72b27d33d79bc6b67

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DF690412E3F3DDCB8A.TMP

Filesize
16KB

MD5
306b564f627428988b026f27ae3fce8d

SHA1
5ab828d0fe2080ea89bb067df3f84647c5234b43

SHA256
26b2c831fdf18fdc493e876251f841dceab0cce6ad34493cf0a9c260507a2a6c

SHA512
7450d13b5a70ae910f0617c2f13f58507500926ebd41f6c2cefd6d27aeb4e1da1e288e7448d5cd23ac528707b66c70656a4bae939c1fe0ba02d2eac15fa324f6

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\K57O7PDP\web-animations-next-lite.min[1].js

Filesize
49KB

MD5
cb9360b813c598bdde51e35d8e5081ea

SHA1
d2949a20b3e1bc3e113bd31ccac99a81d5fa353d

SHA256
e0cbfda7bfd7be1dcb66bbb507a74111fc4b2becbc742cd879751c3b4cbfa2f0

SHA512
a51e7374994b6c4adc116bc9dea60e174032f7759c0a4ff8eef0ce1a053054660d205c9bb05224ae67a64e2b232719ef82339a9cad44138b612006975578783c

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\02JZUP9H.cookie

Filesize
964B

MD5
a84e8ad33c6284feec35552dae394c17

SHA1
7fdb02d0334c44b842abf5137f3d3df8b5eb93c0

SHA256
c35336e2ce956537bdf781846346a201cf9f85310950f8da112043d444c5aa8d

SHA512
a172577f8f228a1fadd4e5265dcdc1103b08c91e048b06cb1123aa90c9a9626411aca45ccd2a0b912eb03670c1bd5fa4064a725782c000d77fc20b5e885cf315

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\1OZHA8J7.cookie

Filesize
130B

MD5
63813f814a517ba130ec8a67c9ad50c8

SHA1
ccd17789b9caa309d79d5a976559187dab7a80e4

SHA256
7305346b5953b3c8a0643d51a0a8466c3ff89ec02162f034f6c4197e65ada586

SHA512
a0beb80e1ed9387d1317ab8310b63b30feaf2410e7d44efefce3ff4510f9025771223f71b0727ae0d967304d66f3c9734d6dbfd6e5d040c5f0e78b38152b7a13

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\3LQEVWI4.cookie

Filesize
107B

MD5
5714780e1fb0bb8d599d13715acecfbf

SHA1
f887b0229392526a59163c856f1b6ec8fafbcaa8

SHA256
b4d1402dc6e12a9f34f5da2db65a18484c640af6a532dc8961a4a94e35011890

SHA512
1c27b620742bb1d83fe9e0acb002c30974555202551d7a1957618d17366f2b1bd2675d52ad1956ac767b3ad18de38a8753cfcea53c1a214d3b711d91f7cbca25

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\7A2KMARC.cookie

Filesize
87B

MD5
44d43a0abdaa7d770dc456e369fd9e59

SHA1
db96aa0d9b7b49f145d25d76a2618b288167c61a

SHA256
276b5568df6147ed61d1a9cb80ca970fb35dd9274b1875793ac844bd4ecd748b

SHA512
71fb4cbf6937071f33bec99666022de0cfceb76d91f7f9024b487ffa9ce57b181f74af269c332fabce8ccc103efa7909b662060224999ed90f85c543f355dd3d

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\7MRA4M8B.cookie

Filesize
91B

MD5
577d691ec8b7704beab38acdfd2c5aa0

SHA1
ed2101d6015f1c15cf411c0e559cd48708681c2d

SHA256
aa5bf6b13b09025232e74f6335fdad03f2a17c805464a7a000e67f6b49d0c68e

SHA512
ce7df0a78e726c037bbf2e56de1cfd4ea19b9aacf4afc2960f5c439f89c97fc426fee42b29588af499b025d19aad0bb7a30e5a13a9d165a3efc57ab34c72f026

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\BO6R3TLB.cookie

Filesize
852B

MD5
eb5b95ec6177968731e84f23e7d61446

SHA1
5ea9a1762365518c66d9ff8f397fcc90a5266d2f

SHA256
c47744f3fbf9aac1861a36998f07caed279f4cb052fe2f44e0710892610c3cdf

SHA512
d111f1b6fb63ebdacdf4587f91abe5b2609eab5847daaf34e6072d184d1e7e39b76db2eca036f0317f77d627f60f26ef31470a8631b7b3bb48b038e3dc0fd0da

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\BR545020.cookie

Filesize
1KB

MD5
67fdd859d5997f02a0d08c64f3f941e0

SHA1
380f45c4ab88cf03c42eef9006d9408c3dbda801

SHA256
b6861f541b048d3c5fafd0207a6f1fd1e438da209809a418be7668e44f8cc334

SHA512
b7b92ec1a838f832df7bcf0f757fce97bb5b0eacb4171c5eb0c1d2db8b743e2ad13072b92e098c97b2a8a5f36116d879d99f5051d3beebc85c12229d14e56128

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\E51W71C3.cookie

Filesize
130B

MD5
91f69b0510b03349e9b0ea55ad992964

SHA1
b871692b549c6e410e8b917b1fbde76b2774f3b7

SHA256
7c2dca9906544e2109ea71e40995bb260f0bca1fab6e0067693ac919fa13dff6

SHA512
7998d672ddb013a63422b9f04d46a0997b56c95184dac5ad16d104385455fd9c1f8d4035f2515b726638426e4857bd46fd447421b54aac74cc935d19439ef69e

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\E80SMNIF.cookie

Filesize
1KB

MD5
8b329d52bdc15ac511e4c54f7900d4b9

SHA1
eb2dacc788ed27f0bb27efd312413b8f4edb3d61

SHA256
9fde71b914dce6f8a831ab11180e16915af04bcc362a2e9c3f21b50f1686698f

SHA512
9f28e99977b62f7dd65d0cd8705d23159c5289f7d32f10d5ea7aa49ceae4164c0efec95205e7c0f04110747f350d26df114677f9880833657a4d95b50c57adc2

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\EGDC5U5R.cookie

Filesize
260B

MD5
b072d38181d17fd7b7772272398ea72a

SHA1
374dca73b96f23c1dfb046b154bc99e9c544a55c

SHA256
c47821c8504d0add85826104f77669aae21210422ed3fa5963bc1f083b9fd17d

SHA512
26b0938ac4291fa623359e036d106821b13c3cc5871e1e7256a0d4d421d84b374a6722b7277ca1708560325adcff4f8024ab3aa2f5fb22b9e2263a187dc65e4b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\FCP45DBG.cookie

Filesize
851B

MD5
d9a26bf7f695018ce1b5fc23938a9a83

SHA1
689ebd73529db0caf569b0cf3ca246f6a06a937f

SHA256
2ab4115838fb27bf98abe687813494e889337b3d0de493fe397061bc73996b07

SHA512
c17dbce0fa89c4d5165dc4ec9594c03d7ef305a8fafaa109b00799e8af8797378f0edb9c6b26d92c58d0b060d6fbb1cd5b9ba101e5714ec7ae9468844a558fde

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\GG9Q3CXA.cookie

Filesize
851B

MD5
b15cf19611b19b3bb5a6267a7989c23b

SHA1
ef9b4a7e92853727f2e81b13c298a660c7479048

SHA256
bae18ca275018f57fbffa0cb3c10c8892a57be292c990125db76c4da8b046956

SHA512
be13cff32d684c13dc62fbf1220b9c10c6b1bfe7f03f8279e0faaa3baf47832e0f5c561ca5c5f26e7bfa7bc54c58a5eb8c07f9e952b416148814088badb1596b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\ITBZRE78.cookie

Filesize
130B

MD5
941b6fe1a6b0750adfd1810c78ad2333

SHA1
0fe3515dd662d74c72c0aeae0cd1728c257c23cf

SHA256
c4cc5082e5edfed63f1df3e73015e34786a6041d215174c7cb38936fd8867f81

SHA512
5c967247a8cb5dfcd66d61b8243af49db5ecbb0077f595293265fece618363ceae516c78106dd7c329be64019f6d81418510322d8d4eda966fa41e311030411a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\IV123C7O.cookie

Filesize
866B

MD5
0f92f7715843972aad511fcb7c1745f1

SHA1
13131d7ed5074e84e328c65979433d2153cd7353

SHA256
26198463fb51c99393784ac2e74aa402fd444b0b104c1baeb69330be4b236a28

SHA512
9fe841306ef7b2d913b3edb1400fe7e96c6094624522e5c7c13024d02f42570fe2331d0e6ccdde424befb87cba53c132bd62bffffd137a5ffc98044a29bd3007

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\JMP11VUD.cookie

Filesize
213B

MD5
d70c26eadffb7be5c5b6f859ce7c93c9

SHA1
18c917a51b1690f20d67a12d63f441ba3a278ca3

SHA256
db8d71b3796347a6c84801f54f6db0f3e5344d0ed57fba683b1dd7ad8be2324b

SHA512
3518c2880909994717395988f832b800e9faa8b49e5d3711bb5b6bf9b408ff60373b73e0a85e0a9bce3236b6afc8dcdf19b660d19351dd17414e7be3e6e928d3

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\RJO619AQ.cookie

Filesize
130B

MD5
5189b68ea6f42526fb955f72d33d4e50

SHA1
e002cf510a57cd87b429a09743555c830cfc17b0

SHA256
74459cb82af4da7d179af108810b452ca3acb7c137ceed66355a50a053474107

SHA512
30e71238ee6cf16fc0c17767d1dd1bdc2a365599cbaa4a5dcb91a820e71a43b1c707de17626128569e3591e9b4940caed6ac686f5c89397249f736ff8b8a7a55

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\S82JWGNQ.cookie

Filesize
852B

MD5
07f4ab6166eeca94d0e1b30587321500

SHA1
49d66deee190c3dafb1dc1b0c938f636dd06fd25

SHA256
599f1014a6741fdbfa206a4591f835f4952ab95dc4d32b6b18cbabb9b00b6cac

SHA512
bae5941a63b958ce6c8c09708a4cec383fb111d9412a2ba4ea4a402e0507cdf07ff58cf40d27c454153e5000e1af3d030ba701751a7fc06697cd237dcc9b9a6a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\XSLF6I1C.cookie

Filesize
851B

MD5
9650901568371ad55b04fda197ea196c

SHA1
b4a763e78c1d5c531b25a1f7c92824c0e6aa6df4

SHA256
632c39135b78718419a5ee47ecb7ab260569fe541214ddd7f4914c33ccd0e0df

SHA512
350b4cbcf3905b9cce9d15c24477675101417854ca7918961bb4de9580464a60ffada7110f349fce9d87efebfb6a8b67929dfa813a3da0a8b1d926244185bb31

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\ZRWZUGSK.cookie

Filesize
851B

MD5
1a0732daa4bba60f91ba22978f574b7b

SHA1
da9f762964128f159fcb6613bcd5b69d6ec02725

SHA256
087c25ed04150782f8228c1f2700601d378eb8add2f3af07bcbe64fc94cb0ce0

SHA512
d89f755c0e484b6aad7cc66bd85545ffdfd65ac61efc972a147e03420bf8fac2cc45d98f923f9565c2107f3074fccd0039414082ef0651452832fb0a62d12fda

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\ZVMJS7AL.cookie

Filesize
851B

MD5
450dfac442a3144bad4da0d4a0aa1d1a

SHA1
4c44a7f0b02d361eff2a214ba3b42306539017ac

SHA256
4644075e28206914d36e3d0298f8e4fc7f1412c17cf8136c4617e5a151273405

SHA512
0300ee789f50b7fbd9cfbce834aed72f63709f4f6fc222806452b7374e9adb2b4d10f2acce1488ce8d63c0280114953352dd45f15c5db4fa6395488e119ddfb9

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
e3766890f61ca03ea878fcc9ce24e884

SHA1
9c959881bb64a0ceb4c891cc654b86318e2e3d92

SHA256
88d9ad3c44b2b6eeea7460354e1f642c3cb12262f2fbab71b9da392aeb9adccc

SHA512
f708bc47dfa03be7e9715efca3f6bbc674fa892f15eb4b8f6859f9816cec56be6e02cc37aad8ce45d55822ee9ad205fb517f559c755a200f5a61cca1b071dfad

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
4KB

MD5
1bfe591a4fe3d91b03cdf26eaacd8f89

SHA1
719c37c320f518ac168c86723724891950911cea

SHA256
9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8

SHA512
02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
4KB

MD5
1bfe591a4fe3d91b03cdf26eaacd8f89

SHA1
719c37c320f518ac168c86723724891950911cea

SHA256
9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8

SHA512
02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
4KB

MD5
1bfe591a4fe3d91b03cdf26eaacd8f89

SHA1
719c37c320f518ac168c86723724891950911cea

SHA256
9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8

SHA512
02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
4KB

MD5
1bfe591a4fe3d91b03cdf26eaacd8f89

SHA1
719c37c320f518ac168c86723724891950911cea

SHA256
9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8

SHA512
02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
4KB

MD5
1bfe591a4fe3d91b03cdf26eaacd8f89

SHA1
719c37c320f518ac168c86723724891950911cea

SHA256
9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8

SHA512
02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

Filesize
1KB

MD5
323cb375873d476d25b49a6f784126e8

SHA1
01c047f0ae0b0995757a5463f7a22208f5be95ab

SHA256
fe65755520e6202c21e89c3f9a1c2de7e571fe1bfe97213b98c23687cddf88c9

SHA512
4d48663f73da2e5074463750e6a6741bba0836b19106b75c1107259023972032def89ea9a176284afe60e6c67b11297cdb6ccae21a79ec49b1d7be9a0ea2d795

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
ac89a852c2aaa3d389b2d2dd312ad367

SHA1
8f421dd6493c61dbda6b839e2debb7b50a20c930

SHA256
0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45

SHA512
c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619

Filesize
471B

MD5
74aafb6960eb1a1720bdefb68a60dcf6

SHA1
bd3586ebb093b0903cc6f5b30482b2197b407070

SHA256
e77d2d8cd2133b5999f2b65066a8c136aaf66468d3bca8d2998ef52e3bcac6df

SHA512
f0cc10094c13b23af1c9f2bb79a6435345c3fed1fdc812ef09736d66762b1545294e620010ad3b4306bbdc9ee191c73b98f43f7278f29c388b06ee5b43616dfb

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_11314361DFE3E655E02EC2E7F9346EC1

Filesize
472B

MD5
f7247870edcefeb7117b8a359b3014b4

SHA1
41725ec7aa91f041ed30a3fdd1e69962cfcdb700

SHA256
e90e89edda8ac292b9669aa872972104c845bd7d174cba1f49479af2bf22ecf0

SHA512
a8328002ce5fdc7f202febe0b09a2d523f6fba01977168930c5868cacb9599e6ea13169c41a1fac379a94afd6d5c16924828d583cf2c3b7e9448efe2bf2918cf

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_57CE1AECC398AD2C94DD1A683EAD09FC

Filesize
471B

MD5
eec0ee56132b8e41319a9796a05509f0

SHA1
a1da6b93c3a63b8925398430421dd0323269184e

SHA256
051287e9bff12dae5fba7b5cabbd99cc0c101395e3fcf8db5c33027a77995312

SHA512
3a0b7a53e964bfaedeab1d13e00ac76f6ac844120ea2a37342da2c370aca302feab2022b5f973251386a03521b6b4bc43c1ee282a9d6ae5446ce04a23f85a8b3

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_57CE1AECC398AD2C94DD1A683EAD09FC

Filesize
471B

MD5
eec0ee56132b8e41319a9796a05509f0

SHA1
a1da6b93c3a63b8925398430421dd0323269184e

SHA256
051287e9bff12dae5fba7b5cabbd99cc0c101395e3fcf8db5c33027a77995312

SHA512
3a0b7a53e964bfaedeab1d13e00ac76f6ac844120ea2a37342da2c370aca302feab2022b5f973251386a03521b6b4bc43c1ee282a9d6ae5446ce04a23f85a8b3

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_57DB0353F73BFEAADC2A8A5ECA70ACE8

Filesize
471B

MD5
5dac04bb185d02ca5f10a60e82561875

SHA1
b8a07b597acce4d6dd5b0bfd05b1481c1e857708

SHA256
ea7b8be0e8d0c3d3a68cc7a96237576f919c2a148dddc0afef8aa11c4a62ea66

SHA512
748781ac9ef6f60f3461a51f55cb14f265e473f187e02b04285741a4d42ba6fb29e9e50dcc0acf9d18afcd81317057fbbd244912d442ce5b4428300f30dae786

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
69f412f05a4dc7786c1f1bbbef7dd1bc

SHA1
50b9ac0c9c3be5b7c8ba0c02185bbf4f8f15f137

SHA256
6a3550b79ad48cf3177c1e4a5aa1b543dec1b3bdbdf9c7d681a298f36e515095

SHA512
7518c6eade094a8266bec8b9c83f9cb5aeb3bd769e01e216845d615af90e4df2ce1dc995425023cd4cf8971a9291a8bef446886949d93b2693206c4b2d11fd16

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
69f412f05a4dc7786c1f1bbbef7dd1bc

SHA1
50b9ac0c9c3be5b7c8ba0c02185bbf4f8f15f137

SHA256
6a3550b79ad48cf3177c1e4a5aa1b543dec1b3bdbdf9c7d681a298f36e515095

SHA512
7518c6eade094a8266bec8b9c83f9cb5aeb3bd769e01e216845d615af90e4df2ce1dc995425023cd4cf8971a9291a8bef446886949d93b2693206c4b2d11fd16

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
69f412f05a4dc7786c1f1bbbef7dd1bc

SHA1
50b9ac0c9c3be5b7c8ba0c02185bbf4f8f15f137

SHA256
6a3550b79ad48cf3177c1e4a5aa1b543dec1b3bdbdf9c7d681a298f36e515095

SHA512
7518c6eade094a8266bec8b9c83f9cb5aeb3bd769e01e216845d615af90e4df2ce1dc995425023cd4cf8971a9291a8bef446886949d93b2693206c4b2d11fd16

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
338B

MD5
9b902e9842a73ec3ea004bafbe2e286f

SHA1
d64bf1db27cfc464aab0f5a1c532afc4b7011fc5

SHA256
8a886cf6324743e1e92868b4eb7a636cc8648b00dc640be6cb0050f8305158e1

SHA512
93ee364fb5c3e1b883821e2ce4b7119a8f045f838153c7a8f8f17b84921ddc4c1681563354dcafbb3807a0bf140cfda9cdfeed61c4b978730b9ac291491ed4a4

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
338B

MD5
5cc1b9a74d382340ac45e3d7f38f537f

SHA1
74aa4e09ebd2add70ff3c83b87f2e905813a82e0

SHA256
effbb9e5b2ec0d5695def3ee32b85be666ebcddf7feeb0204f2636a83d4d2db7

SHA512
15a901106bb21ad3dac0bde60777a734f96f4c09f9eb0233c1a92b0da7b801381a42063219a490ae057972b1dd8d783ea9afb2faff5adea591d0edade0ef4681

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
338B

MD5
48a42ec76511fb5a4219cae43ff9b5f3

SHA1
18ec4723c68e71066cb30dcd3d976b70fbd41c28

SHA256
fe8ed09dddfacf45cecf22e44679f331a787d209343803193745a3ccac086c09

SHA512
b6dd3644019452d7d4d6076a8d701402b6a9bbeb81c9fd1798d1725f971ebc1b297e51a086420c861f9ea43275ff74268893731548daae0befb7cf9399a4f46b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
338B

MD5
48a42ec76511fb5a4219cae43ff9b5f3

SHA1
18ec4723c68e71066cb30dcd3d976b70fbd41c28

SHA256
fe8ed09dddfacf45cecf22e44679f331a787d209343803193745a3ccac086c09

SHA512
b6dd3644019452d7d4d6076a8d701402b6a9bbeb81c9fd1798d1725f971ebc1b297e51a086420c861f9ea43275ff74268893731548daae0befb7cf9399a4f46b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
338B

MD5
48a42ec76511fb5a4219cae43ff9b5f3

SHA1
18ec4723c68e71066cb30dcd3d976b70fbd41c28

SHA256
fe8ed09dddfacf45cecf22e44679f331a787d209343803193745a3ccac086c09

SHA512
b6dd3644019452d7d4d6076a8d701402b6a9bbeb81c9fd1798d1725f971ebc1b297e51a086420c861f9ea43275ff74268893731548daae0befb7cf9399a4f46b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

Filesize
408B

MD5
d8341545f7df33d90cd8773b09a6819a

SHA1
318eb6d2a43aeabe36175de6e0ff831446909195

SHA256
5c8586977c594e6e192d9c226ac8b36fc756d0fabb452144c8438af40083496d

SHA512
98472654a5430a482a010cf69cd29ef32acb14fdafa52a8c76b7dd1a72adc75bf257b2c9d474e04bef15b734061bd10c33aca9f5c2934281de19584abb86ec97

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
48feab699b590e0da455848305d8f7dd

SHA1
d701ed4e4ccf9d4d87505bac46ef3d30bc650acd

SHA256
8735383d39c250ca80cdab4b1dfa092ffeb5dc6812282f08f7a907cec76650ca

SHA512
4904c79faf960437eb2a326a2a305e15af6c2758725d3ffdfaeaf64ea3acdd797e52bd3a8c95c7849adff4e7f5397a8e942231b28d63b067e7086078f5a90eea

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
48feab699b590e0da455848305d8f7dd

SHA1
d701ed4e4ccf9d4d87505bac46ef3d30bc650acd

SHA256
8735383d39c250ca80cdab4b1dfa092ffeb5dc6812282f08f7a907cec76650ca

SHA512
4904c79faf960437eb2a326a2a305e15af6c2758725d3ffdfaeaf64ea3acdd797e52bd3a8c95c7849adff4e7f5397a8e942231b28d63b067e7086078f5a90eea

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619

Filesize
400B

MD5
a383c3b813462929718317519299034c

SHA1
15714929310d6961edd09d44bceccd84a44a8824

SHA256
c09f2c1d30afe620cb308482289cf058fe2dc886bb06f15f2dd0b26447254186

SHA512
23717f29341c85c21be79c5aff3e04a8311362df34d40421d8960b884c3a49910f4b3c938aa281dc41bc8346a288a4b803309a84c4592df69f52b4d58043fbae

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619

Filesize
400B

MD5
a383c3b813462929718317519299034c

SHA1
15714929310d6961edd09d44bceccd84a44a8824

SHA256
c09f2c1d30afe620cb308482289cf058fe2dc886bb06f15f2dd0b26447254186

SHA512
23717f29341c85c21be79c5aff3e04a8311362df34d40421d8960b884c3a49910f4b3c938aa281dc41bc8346a288a4b803309a84c4592df69f52b4d58043fbae

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619

Filesize
400B

MD5
4bdda239cf9ccb30d0eee97eaf48bbd2

SHA1
5494fbaf6dd342835bdf08fe2fd97ebfc2c79cad

SHA256
26c89175a6220f10a182d6ecf0294b1ccde0901d423aea31449145691361bdb3

SHA512
459612b8a42406271df9e90ef644c676ffb3d555ec620d2db40657c86b5348d6573b8e7dca9cd20cfb2ce73e4030bcd7cd7cbe44af1c62bf8b14a08bed5f0ab3

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_11314361DFE3E655E02EC2E7F9346EC1

Filesize
410B

MD5
7e0078dcc4947044a4b33370b8612257

SHA1
80f21da279c1a6924725037813a674ca1e951ed0

SHA256
8e1b309190d919806589bbcf32a842556e248d49b13c2f62ef12942e584fc804

SHA512
f3b3fd054ab5446e3374a9329a538810c0d15a6a9061befe7419160a7acdbaa646322e74bd32778bbc72ecfdf2ded96111fcce6189ffca2ecd3e9e9c1354ee06

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_57CE1AECC398AD2C94DD1A683EAD09FC

Filesize
406B

MD5
8d1f3b527f394e4843663d9286ac18c1

SHA1
289eac3c00ba1d0550bc926b11e2218a61bb59d4

SHA256
20817537b98d9f3bc3f38ae39b2f9571dfd80e39b3d363c299b35ffe8b08b261

SHA512
570805f5a37b6f6ba14ccb1432747ad8358abb75d44df442a24a115811847930be173fed587def904ab541dd30ceb21a07f201382dcb4ac2fd99216cef182b79

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_57CE1AECC398AD2C94DD1A683EAD09FC

Filesize
406B

MD5
4c4532f82cc20f976a2e5e4fd19171a1

SHA1
242140fbe97da70120d78ddac0421a7e585a0abc

SHA256
599f55c135677dd7d2d1fc7fd650e2d92a39d53468ef36a2f329c3b508337b3f

SHA512
1bd1d666b4c7d08252ab8a6b8a0bef306ac8a862498d887736c887cd35404317a92cfc4cad27d21564e5e4a0bf86298174fcdd28fb87ff81d0cab781288402af

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_57DB0353F73BFEAADC2A8A5ECA70ACE8

Filesize
410B

MD5
565b8d3d3d3deb27afa7ffe7851d7faf

SHA1
9d62ee9dcb3163eee831312f671912f69a4d19c4

SHA256
58b93cf2b83a9e1279b0baac919f1a5d88f6eb05826627bc27ebd17c5bda34ab

SHA512
2811d8b0f22cf4da79a7093bd14663d48fb0362201b6d62ff8eab084a89ce5f0f2ae8a93053c984319c08b13b25ec24e56497db3df3dbf37eb0acea9a7ed4886

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\13uw990.exe

Filesize
624KB

MD5
74cde100b2df8f1d552c142c76d7051b

SHA1
f398a292a216d3b372cd8bbe8173fe4127431b80

SHA256
c37e333ac10692ba6862402ee4b0840c2f2a1914f7037d7daaedf9236e73cb8e

SHA512
0ba470af39b7dd88ab3e050bdf38832fc7a93534bf5fa9cb803bef8adbd05bef0de056a00ae06c8c72560c7fce085ff48db385a84b485597fae492f659172bf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\13uw990.exe

Filesize
624KB

MD5
74cde100b2df8f1d552c142c76d7051b

SHA1
f398a292a216d3b372cd8bbe8173fe4127431b80

SHA256
c37e333ac10692ba6862402ee4b0840c2f2a1914f7037d7daaedf9236e73cb8e

SHA512
0ba470af39b7dd88ab3e050bdf38832fc7a93534bf5fa9cb803bef8adbd05bef0de056a00ae06c8c72560c7fce085ff48db385a84b485597fae492f659172bf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Jw9Xw49.exe

Filesize
877KB

MD5
75622ee3388dc2fef5a1362c865dc17e

SHA1
25bedfb2472c2e5ad5c25b3d9b95f6daa561dfcd

SHA256
906c7d044497af179ab7cc5f3057a4f466a2025cee5fe7cc70a4c5ab88cec5b8

SHA512
55f18108337eacb4c884a3d7dcb8a0234113ad1a03cdda2e91fb61caea8e99265d98cb52087a3569c91f2d234a8b1640a275f4bb5230d2826d4d789ffce528ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Jw9Xw49.exe

Filesize
877KB

MD5
75622ee3388dc2fef5a1362c865dc17e

SHA1
25bedfb2472c2e5ad5c25b3d9b95f6daa561dfcd

SHA256
906c7d044497af179ab7cc5f3057a4f466a2025cee5fe7cc70a4c5ab88cec5b8

SHA512
55f18108337eacb4c884a3d7dcb8a0234113ad1a03cdda2e91fb61caea8e99265d98cb52087a3569c91f2d234a8b1640a275f4bb5230d2826d4d789ffce528ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\12Dn078.exe

Filesize
315KB

MD5
7f2751c8b57f9fa4753d5d1414a4dbef

SHA1
25481a4c0b0fc0ae37586d12e13712db53f1d0e9

SHA256
9f376f3247273df9661a326bb667aa6518aabca20acd1e0f820c92b6c0579dde

SHA512
a100e065ed119f41e02c5728577768dca01e624b2052a6bffc95cbcf562a03cbd90db2c9eccade85ab15968c7e407cdf18c8bc8270eba649a29625a5f2497ccb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\12Dn078.exe

Filesize
315KB

MD5
7f2751c8b57f9fa4753d5d1414a4dbef

SHA1
25481a4c0b0fc0ae37586d12e13712db53f1d0e9

SHA256
9f376f3247273df9661a326bb667aa6518aabca20acd1e0f820c92b6c0579dde

SHA512
a100e065ed119f41e02c5728577768dca01e624b2052a6bffc95cbcf562a03cbd90db2c9eccade85ab15968c7e407cdf18c8bc8270eba649a29625a5f2497ccb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\uB6hG11.exe

Filesize
656KB

MD5
91362448abc61956603e3add03dfda3b

SHA1
a797f165840fc89225807664bf2092b09bd7bd0c

SHA256
a0c59491384562a15a5117665047d8d5dcf1fda4e88791cbeb719176b9cc75b6

SHA512
693e4a9401adc30d51d4fc41a762ae33b39d8ad82d798bde9c4d0ffbb5f49f8eac6636365b173e0b974d0f5ed7aa0422b0d057914c19a2f650c33a2212eaf90b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\uB6hG11.exe

Filesize
656KB

MD5
91362448abc61956603e3add03dfda3b

SHA1
a797f165840fc89225807664bf2092b09bd7bd0c

SHA256
a0c59491384562a15a5117665047d8d5dcf1fda4e88791cbeb719176b9cc75b6

SHA512
693e4a9401adc30d51d4fc41a762ae33b39d8ad82d798bde9c4d0ffbb5f49f8eac6636365b173e0b974d0f5ed7aa0422b0d057914c19a2f650c33a2212eaf90b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\10ZK42zz.exe

Filesize
895KB

MD5
d6022564257f219af36a3f9eb08bf087

SHA1
63569cdf2de19ff4aa376a691e865bb7a251b456

SHA256
c0ef3a77375113ff1e467111311dc50d9492ee0b1a69060ada68800a765530ea

SHA512
0fcd8984811475e7b34e57bd8768921d1ea355e9dd3e8d03b4700546b254c96c5b1ffae829e81bf88acfe4cd38b409487d78cf51f9b620058df914bf92e49d70

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\10ZK42zz.exe

Filesize
895KB

MD5
d6022564257f219af36a3f9eb08bf087

SHA1
63569cdf2de19ff4aa376a691e865bb7a251b456

SHA256
c0ef3a77375113ff1e467111311dc50d9492ee0b1a69060ada68800a765530ea

SHA512
0fcd8984811475e7b34e57bd8768921d1ea355e9dd3e8d03b4700546b254c96c5b1ffae829e81bf88acfe4cd38b409487d78cf51f9b620058df914bf92e49d70

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\11EU9903.exe

Filesize
276KB

MD5
0173e85f7c7d8d639092b2616470f9f1

SHA1
c479fdab9808a09285df39443ac9c58688fd5428

SHA256
e9ffc6d2d2c202b8820fa3b99c778d93ac1dbf20b88a12830b91d161524a0372

SHA512
f93fa00b884e519685a74692ec049a7421b8e16108152f2fab903c41d772cfe3ffedb52bf2f245f42501187a50f0fd27811f0f21dcf90aa7bba866a58f746b3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\11EU9903.exe

Filesize
276KB

MD5
0173e85f7c7d8d639092b2616470f9f1

SHA1
c479fdab9808a09285df39443ac9c58688fd5428

SHA256
e9ffc6d2d2c202b8820fa3b99c778d93ac1dbf20b88a12830b91d161524a0372

SHA512
f93fa00b884e519685a74692ec049a7421b8e16108152f2fab903c41d772cfe3ffedb52bf2f245f42501187a50f0fd27811f0f21dcf90aa7bba866a58f746b3c

Download Submit
memory/1572-100-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/1572-97-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/1572-98-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/1572-96-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/1780-653-0x00000269BD3E0000-0x00000269BD4E0000-memory.dmp

Filesize
1024KB

Download
memory/1780-600-0x00000269BB900000-0x00000269BBA00000-memory.dmp

Filesize
1024KB

Download
memory/1780-430-0x00000269BB040000-0x00000269BB140000-memory.dmp

Filesize
1024KB

Download
memory/1780-323-0x00000269BA770000-0x00000269BA790000-memory.dmp

Filesize
128KB

Download
memory/1780-440-0x00000269BB040000-0x00000269BB140000-memory.dmp

Filesize
1024KB

Download
memory/1780-448-0x00000269BC0B0000-0x00000269BC0D0000-memory.dmp

Filesize
128KB

Download
memory/1780-646-0x00000269BD3E0000-0x00000269BD4E0000-memory.dmp

Filesize
1024KB

Download
memory/1780-628-0x00000269BC450000-0x00000269BC470000-memory.dmp

Filesize
128KB

Download
memory/1780-658-0x00000269BD3E0000-0x00000269BD4E0000-memory.dmp

Filesize
1024KB

Download
memory/1780-595-0x00000269BB900000-0x00000269BBA00000-memory.dmp

Filesize
1024KB

Download
memory/1984-21-0x000001EFD7C20000-0x000001EFD7C30000-memory.dmp

Filesize
64KB

Download
memory/1984-429-0x000001EFDF490000-0x000001EFDF491000-memory.dmp

Filesize
4KB

Download
memory/1984-37-0x000001EFD8500000-0x000001EFD8510000-memory.dmp

Filesize
64KB

Download
memory/1984-56-0x000001EFD7DF0000-0x000001EFD7DF2000-memory.dmp

Filesize
8KB

Download
memory/1984-419-0x000001EFDF480000-0x000001EFDF481000-memory.dmp

Filesize
4KB

Download
memory/2172-621-0x000002DD7C6E0000-0x000002DD7C700000-memory.dmp

Filesize
128KB

Download
memory/2172-357-0x000002DD7C900000-0x000002DD7C920000-memory.dmp

Filesize
128KB

Download
memory/3800-74-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3800-77-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3800-78-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3800-81-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4204-464-0x00000277554C0000-0x00000277554C2000-memory.dmp

Filesize
8KB

Download
memory/4204-446-0x0000027755490000-0x0000027755492000-memory.dmp

Filesize
8KB

Download
memory/4840-200-0x00000230BC560000-0x00000230BC580000-memory.dmp

Filesize
128KB

Download
memory/5028-101-0x000000000B2F0000-0x000000000B2FA000-memory.dmp

Filesize
40KB

Download
memory/5028-125-0x000000000B5B0000-0x000000000B5FB000-memory.dmp

Filesize
300KB

Download
memory/5028-93-0x0000000072740000-0x0000000072E2E000-memory.dmp

Filesize
6.9MB

Download
memory/5028-94-0x000000000B760000-0x000000000BC5E000-memory.dmp

Filesize
5.0MB

Download
memory/5028-106-0x000000000C270000-0x000000000C876000-memory.dmp

Filesize
6.0MB

Download
memory/5028-3186-0x0000000072740000-0x0000000072E2E000-memory.dmp

Filesize
6.9MB

Download
memory/5028-95-0x000000000B300000-0x000000000B392000-memory.dmp

Filesize
584KB

Download
memory/5028-113-0x000000000BC60000-0x000000000BD6A000-memory.dmp

Filesize
1.0MB

Download
memory/5028-114-0x000000000B550000-0x000000000B562000-memory.dmp

Filesize
72KB

Download
memory/5028-118-0x000000000B570000-0x000000000B5AE000-memory.dmp

Filesize
248KB

Download
memory/5028-86-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5076-694-0x00000144AC060000-0x00000144AC080000-memory.dmp

Filesize
128KB

Download
memory/5284-373-0x0000027AE0C80000-0x0000027AE0CA0000-memory.dmp

Filesize
128KB

Download
memory/5284-412-0x0000027AE0900000-0x0000027AE0920000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads