hxxps://tlauncher[.]org/

Analysis

max time kernel
88s
max time network
89s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
24/02/2024, 15:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://tlauncher.org/

Score

8^/10

upx

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
4132	TLauncher-2.899-Installer-1.1.5.exe
2072	irsetup.exe

Loads dropped DLL 3 IoCs

pid	Process
2072	irsetup.exe
2072	irsetup.exe
2072	irsetup.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000600000001acb8-865.dat	upx
behavioral1/memory/2072-868-0x0000000001070000-0x0000000001458000-memory.dmp	upx
behavioral1/memory/2072-1155-0x0000000001070000-0x0000000001458000-memory.dmp	upx

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\PersistedStorageItemTable\System\{41165C55-FF65-45B8-A24F-CEAD373B32	browser_broker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\NextUpdateDate = "415554168"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\tlauncher.org\ = "480"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState\EdpCleanupState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\tlauncher.org\Total = "529"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\tlauncher.org\ = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\tlauncher.org\Total = "125"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\tlauncher.org\Total = "940"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$Telligent	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 9cc94ccb3767da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\tlauncher.org\Total = "111"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "140"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 5d681cb73767da01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\tlauncher.org\ = "89"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\PersistedStorageItemTable	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "89"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\tlauncher.org\ = "61"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\PersistedStorageItemTable\System\{41165C55-FF65-45B8-A24F-CEAD373B32 = "0"	browser_broker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Rating Prompt Shown = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CTLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\tlauncher.org\Total = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "561"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\tlauncher.org\Total = "480"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\Total\ = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\tlauncher.org\ = "874"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\tlauncher.org\Total = "545"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{61EFC99E-490D-4EEE-9F83-049DA5C3E732} = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2852630833-2010812756-3750823755-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache	MicrosoftEdgeCP.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\TLauncher-2.899-Installer-1.1.5.exe.yh1egn3.partial:Zone.Identifier	browser_broker.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
1536	MicrosoftEdgeCP.exe
1536	MicrosoftEdgeCP.exe
1536	MicrosoftEdgeCP.exe
1536	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3208	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3208	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3208	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3208	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	396	MicrosoftEdge.exe
Token: SeDebugPrivilege	396	MicrosoftEdge.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
396	MicrosoftEdge.exe
1536	MicrosoftEdgeCP.exe
3208	MicrosoftEdgeCP.exe
1536	MicrosoftEdgeCP.exe
4132	TLauncher-2.899-Installer-1.1.5.exe
2072	irsetup.exe
2072	irsetup.exe
2072	irsetup.exe
2072	irsetup.exe
2072	irsetup.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1536 wrote to memory of 4344	1536	MicrosoftEdgeCP.exe	78
PID 1536 wrote to memory of 4344	1536	MicrosoftEdgeCP.exe	78
PID 1536 wrote to memory of 4344	1536	MicrosoftEdgeCP.exe	78
PID 1536 wrote to memory of 4344	1536	MicrosoftEdgeCP.exe	78
PID 1536 wrote to memory of 4344	1536	MicrosoftEdgeCP.exe	78
PID 1536 wrote to memory of 4344	1536	MicrosoftEdgeCP.exe	78
PID 1536 wrote to memory of 4344	1536	MicrosoftEdgeCP.exe	78
PID 1536 wrote to memory of 4344	1536	MicrosoftEdgeCP.exe	78
PID 1536 wrote to memory of 4344	1536	MicrosoftEdgeCP.exe	78
PID 1536 wrote to memory of 4344	1536	MicrosoftEdgeCP.exe	78
PID 1536 wrote to memory of 4344	1536	MicrosoftEdgeCP.exe	78
PID 1536 wrote to memory of 4344	1536	MicrosoftEdgeCP.exe	78
PID 1536 wrote to memory of 4344	1536	MicrosoftEdgeCP.exe	78
PID 1536 wrote to memory of 4344	1536	MicrosoftEdgeCP.exe	78
PID 1536 wrote to memory of 4344	1536	MicrosoftEdgeCP.exe	78
PID 1536 wrote to memory of 4344	1536	MicrosoftEdgeCP.exe	78
PID 1536 wrote to memory of 4344	1536	MicrosoftEdgeCP.exe	78
PID 1536 wrote to memory of 4344	1536	MicrosoftEdgeCP.exe	78
PID 1536 wrote to memory of 4344	1536	MicrosoftEdgeCP.exe	78
PID 1536 wrote to memory of 4344	1536	MicrosoftEdgeCP.exe	78
PID 1536 wrote to memory of 4344	1536	MicrosoftEdgeCP.exe	78
PID 1536 wrote to memory of 4344	1536	MicrosoftEdgeCP.exe	78
PID 1536 wrote to memory of 4344	1536	MicrosoftEdgeCP.exe	78
PID 1536 wrote to memory of 4344	1536	MicrosoftEdgeCP.exe	78
PID 1984 wrote to memory of 4132	1984	browser_broker.exe	80
PID 1984 wrote to memory of 4132	1984	browser_broker.exe	80
PID 1984 wrote to memory of 4132	1984	browser_broker.exe	80
PID 4132 wrote to memory of 2072	4132	TLauncher-2.899-Installer-1.1.5.exe	82
PID 4132 wrote to memory of 2072	4132	TLauncher-2.899-Installer-1.1.5.exe	82
PID 4132 wrote to memory of 2072	4132	TLauncher-2.899-Installer-1.1.5.exe	82

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\LaunchWinApp.exe
"C:\Windows\system32\LaunchWinApp.exe" "https://tlauncher.org/"
1⤵
PID:212

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:396

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\TLauncher-2.899-Installer-1.1.5.exe
  "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\TLauncher-2.899-Installer-1.1.5.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4132
- - C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
    "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1910546 "__IRAFN:C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\TLauncher-2.899-Installer-1.1.5.exe" "__IRCT:3" "__IRTSS:26073958" "__IRSID:S-1-5-21-2852630833-2010812756-3750823755-1000"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2072

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1536

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3208

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4344

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:1488

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\16cf3096143a4a6db897a1b12727909b /t 4644 /p 2072
1⤵
PID:820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
4KB

MD5
1bfe591a4fe3d91b03cdf26eaacd8f89

SHA1
719c37c320f518ac168c86723724891950911cea

SHA256
9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8

SHA512
02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7HB61I1H\edgecompatviewlist[1].xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\1GKQUBFA\api[1].js

Filesize
917B

MD5
85b20ef6728730c6c98ccf11716f4d3c

SHA1
b0280aa6e45447a7cd978a0619a51336f8fad860

SHA256
ef6e3f7c181dc00a0713d63f9e5bba4346694198d95e489bfbfbedca50f77f26

SHA512
b8c82f220a33f4acbcc604ce5c176f0c9168febaea174ffe2d0b49fddaa7fc4227a11611826027fe3dfda73d2ea820c2049e49d73844b87ecb094bf4ae452250

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\1GKQUBFA\bootstrap.min[1].js

Filesize
34KB

MD5
834ca905c3251172e3c538cc0e043d77

SHA1
313da686ebbe387064f2d1899c64ea562b81eb40

SHA256
9a61a325508cd509f23cd31043b878957281f0a3603d8e7d40758c4a7c489d5a

SHA512
5e874136dc93a656f38effbdeb86470d6b4e08254161a7cc4f00391ca3b44e9c06dfa45e9929b7039d85a1e9dcf6f4455b0fb06a0d1a63dcf16cbe2825367323

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\1GKQUBFA\index[1].js

Filesize
1KB

MD5
5f5db2186f77acefebdd8247e961753a

SHA1
a0030fc8367abe017b57997c373ab01d41f61b04

SHA256
cf57672a8a92b5256133e948a4d935fd6210032c66411f42e7eef9189e6a88b8

SHA512
8d44cd182157313bad0a0b5ede4a8f4f99bf56614a5c589711776091e18f9c00f73500434c92c8530eb8b9757003b5115f39a250ebc3db8937cbd33187142eec

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\JJEYEYNH\PFBeauSansPro-BoldItalic[1].woff2

Filesize
98KB

MD5
432dc1f985e2e8c8695c47da0208fae3

SHA1
504fd635964607614c04e4262cf8dd94aa679687

SHA256
4f6f3e485c903c7d9377177418a20ae789fee01bd702aeebfd60913a184bb47f

SHA512
1a53a32e4b3ad49109ea811866ab4e1731f1fcd2a2e0dfa798ec8688d72685498b44c37f19ab39dff637f62e406e5de28f77bc0ad16ade41d14aae04a15f4b41

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\JJEYEYNH\PFBeauSansPro-Regular[1].woff2

Filesize
100KB

MD5
fc174d909e9526fdb7a0a651115f9681

SHA1
c5623230322adfef099be2bf25e0a2fe9bbc521a

SHA256
47c20218ddb7ebb8d8b4482d73f87856a75f7062f3b0fd2401b4e6622041e781

SHA512
3a3059231c7513c528d96d4f7793989a9846de0c08dd5af90100c351432283b1ce8485307d74c56afa403c32b61005d92ecf956d764d54277bfcb778daa66672

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\JJEYEYNH\bootstrap.min[1].css

Filesize
114KB

MD5
c3d736f4400b9451e591ff09606d7af0

SHA1
d2333a926ae25bbd3056814f13fec0843468e49e

SHA256
c8451f97c65f01678d0137afa161c420303896e68dd27460b385712e1cc82db1

SHA512
d353430dce90bdb12ed18a44d84f4c78770146783f9d13fe3e3ed16f5731beeb3b6fcf29f94ce7c8ad32f047ec3cb291a6ad28aabfb0b37255c57671efdb7b28

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\JJEYEYNH\common[1].js

Filesize
7KB

MD5
83703f5b2bf411129851bcbdef447733

SHA1
016f9e5a9e617abbdd35b1075758b0a041868969

SHA256
66898b8470b46d308abe6e002cb8c6220bc1b742595fafbe199efa9e7e75377e

SHA512
cfe042da70d5742278e143d42d8e4fc6435d874f8aca1f216ef8271b15f53cd87e132cc5f2ab473961764c5fe32f59defce2a0ec082b371476a77e86658038c2

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\JJEYEYNH\index[1].css

Filesize
4KB

MD5
4fb6d8cfd4b469df07290bbdd7fad307

SHA1
18017e013fb5cbb9ee6230b517570a85b9aa0d87

SHA256
5d812aeb8cf26d1865d11e6f41066bb9127935a4a50e5048dd2f473ef628b690

SHA512
51550090cf48444c541bbc8ae373454bee57ecc6fe0bb5033469a81f735e22b7a45226cba0b95f20c92cc7c9fb04da5d2522ca4b1e9f8d819a7b090521b5b231

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\JJEYEYNH\jquery-11[1].js

Filesize
93KB

MD5
b1860d4cedb72cf0e323b5f5f2ad907d

SHA1
20f329d6b2f42e4014601a1fb91b863359edd850

SHA256
68af4c5878b9d0040bc9bb8663e9018bbcddd89a2520d6470dfeafed4e2cfd3a

SHA512
c0c72b5fca56778b7b67daca31cb19b670058d031eecab78117211af367201e201d5620db1637e78c4b356d9993cbb249b54984e497d292bd36139b2f4fe435d

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\JJEYEYNH\moment[1].js

Filesize
86KB

MD5
0be5a6e5cdf843fed45c04f9da71bf5a

SHA1
20574b61e73eadf2ae13d9113f0e3bdd580053a9

SHA256
77ec359e69f8da9a9b7907cd783343a157814f4e8874e3f250bec4c49608baef

SHA512
9628999d7b9e5ac44ff34446e7d1a897540713847e395821e55f747bb6e9401e550915762703d2f1d2e0c912d0609d8100800a57d910899db79dc497ea508f22

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\JJEYEYNH\osselector[1].css

Filesize
3KB

MD5
2ea144d617ba26020df59acb842a7eaa

SHA1
713b546c30fc9ca13db4a999f4806e2e9c0ab9d1

SHA256
54fd120de8f7f8987e2eca9c2fa5fe6ff990cffc69f8b4d88749ecd6e9b6b05f

SHA512
91d373097f38af086c233660cf8ecee9a5bf8ed1154d3068eefd310d861eabdee1a642a1602cef1b43e8cca625b70cb067f31b43404325764d5b59792a347d8d

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\JJEYEYNH\style[1].css

Filesize
24KB

MD5
c8a2db509d6816f5950e092d42750b39

SHA1
03669bf2efa10ec686bda506e1430dccb2346dd8

SHA256
bcce4437719810c795d3dd0ed8dacead3fec7820ae41483135786ff057e8a0e3

SHA512
4a86762eeef3679f943a4c57e08102c867575eced05cdf0bd5628f9db9e1364841e073ec038433848218332a280c9890f24355d125eee9efec00236e3b32dbd7

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\MPNBHK5U\PFBeauSansPro-Bold[1].woff2

Filesize
98KB

MD5
e126eb7c9c831da3df57436217619c66

SHA1
e5814c5c0c2dd106e5e6399cb1c2d42409561949

SHA256
19b7bfbfb7acdaa05f362b1c2fd1e68a201a3b26f232ba69392d4bacee5650ba

SHA512
d84e6fcaf61104f63e1e19d7feae87527e8424d5bf69e16e2a769845b78e012dbf6eac1ada30b7692cf66fa2de7300553d2d8afc5fdb8cda7894f83d7d2498b6

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\MPNBHK5U\PFBeauSansPro-Italic[1].woff2

Filesize
99KB

MD5
aadf0120c8f708c8eae73465ff4e43ef

SHA1
ae72724ebe0557bee7a2b2722a6f941a85fa09b5

SHA256
53f77202b728ca2f14ae72e58a09425b4627f10a8f920a943ae5ca31e50d28f2

SHA512
a6146d38a79e6da5241558a354ea23948acbe2ded36a84023a7eda393d3c43b7fda548ed72f9f8df045de822a0e3513393aa69a8b4f2fcf447e52fb9043c972a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\MPNBHK5U\adavptive[1].css

Filesize
21KB

MD5
7aadd6d208f4a542093a13a40189ede4

SHA1
0da82f99425d1247aba84d330155f02d8e62b389

SHA256
64a74af753bcacfb1bffdcb09d0a5b1d621867693ddd04396ac79ba05943c7d0

SHA512
dadff3bbea31ed491a21ae70f772a97a78faad7c3004f31d78d6868be662b91c711f2b06af0064bfae499c702d0011e19d0c970f735c56f49d5902064f51f44a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\MPNBHK5U\recaptcha__ru[1].js

Filesize
525KB

MD5
5998431f07823607a0bdf7e584fb3266

SHA1
4437f0fcda3993f1e2e16a24dea81b618c4da668

SHA256
60464390451b0a3b72985035d7d0723fbb660275c404f817a28b72023d52e5c4

SHA512
e6d0bc3dd2c27e2d5fc9ed4a7a0ae929b8a8abc8cc60357e28380969e0be048d7acca3ee227be4f4078001d0594e2bce83c8ccc51a335f4757c5f42d85a57670

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\MPNBHK5U\tag[1].js

Filesize
218KB

MD5
639dcfc4ef2f737171b3f3803c67fb10

SHA1
829043488d612e8405fb045413a06b09e3bb3b76

SHA256
3afb51595de7dc8a7627219990286c290fc5d538759fad4c642fc6dd7918e797

SHA512
1f07f513e156911d70cd8136cd442861735fec6e5166d65c29c8e12d10bb8249bd8ccd76bc520ec20b7f4d0e4d7bd9419d5374904f9c3a00687f47eb528f26a6

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\MPNBHK5U\underscore-min[1].js

Filesize
17KB

MD5
66e46fdc840c68d4ba9d8c6bd6ea9cfa

SHA1
69b8b33acbd62281920d4b73c310c66c4cfc8992

SHA256
1bb03826b26326516a3f4c9a9b39f03e3000a4828f91a75e1dfc88c2269af5ed

SHA512
7bade1241e3f57546349eb144f8476a0eab8df7229e2f53a658a75511c9e3fca3c0376b95b4b1c8e0fb8d882e76ec2baa793835946d1fbdae90ce5a244cf2321

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\YTQMOG52\api[1].js

Filesize
375KB

MD5
7f35e4fe3d2d86e23aafe1f8be721b04

SHA1
95ec881c1d2e5ff5d9251f99439068931e78bc4d

SHA256
e371afad4e5536dc457e1940102546d5f8e551e63c740bd9915d40356ac58b5b

SHA512
294fa7cc9248f41f9e5718b34de66fbebf41a7a9d749521738e180801fe4b3529022fe383881ae3a593234285d8fb85258720bed4e6f9c8198a54d14ed758a43

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\YTQMOG52\knockout-latest[1].js

Filesize
66KB

MD5
c9b2a27b4a888e6a2ac7d20292c2e13c

SHA1
171d836afe9ffb28fad44b470c04f57c50f1449b

SHA256
e6472ea3301fe6b2fc3f3224b36cef4f4bbfcd1429f7a20b5f57eb392928b6dc

SHA512
a6c391b2fb45c4a33168e43853e9092590af858e445f3705f2e1fbc98c8808cbe87935b73cfc1709900983c2ac01b787b903bfa41ff0a51221459383f9bc4549

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\YTQMOG52\v84a3a4012de94ce1a686ba8c167c359c1696973893317[1].js

Filesize
19KB

MD5
dd1d068fdb5fe90b6c05a5b3940e088c

SHA1
0d96f9df8772633a9df4c81cf323a4ef8998ba59

SHA256
6153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101

SHA512
7aea051a8c2195a2ea5ec3d6438f2a4a4052085b370cf4728b056edc58d1f7a70c3f1f85afe82959184869f707c2ac02a964b8d9166122e74ebc423e0a47fa30

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\YEIEOE0K\tlauncher[1].xml

Filesize
86B

MD5
91b8f537bb344016b5d682b4872635d5

SHA1
39e48a6084a9059db463f7529e91e0a85ab83031

SHA256
05eb23e341bf1e8731732ffbf00943866ba89ed8fe7df1acece5451e1936e45c

SHA512
ce5b5e82a8fc0106afe1c2bca35927a01a0dc4d7e345b0d249af5e44c0a2c9b2a3f420cf71b6081b7579bbd7ecfe77fc44b4fc16b81b1399cf6f43a79dbaca4d

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\YEIEOE0K\tlauncher[1].xml

Filesize
356B

MD5
ed9e0d1de8177971d93c4d554c23cd40

SHA1
6cfc660a891be5ca41fdd5715e0aa8dc08624859

SHA256
7e42d90a098a512f1924f47ccae5eb4d5613e5359129c57a7012c6b6faab372d

SHA512
e72e8ee870ea818510d6cc0c033f0990acf1b37c22a14fb1997af1d805cd7df460e9151c5326745828781ad966a0673eb39e5b9202c45d871822bd613854a113

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\YEIEOE0K\tlauncher[1].xml

Filesize
1KB

MD5
d76048ea154b2b6b42156df3d20b2a34

SHA1
7e5f743214fe2eb4541bb9f08429f541868dd627

SHA256
380163fbf0c5d1cf4c75e21302d0ed1e6834420c6b17290d9fb9374c70e347e4

SHA512
780ba0c866ca6152b58979e72de4d0bd65c8e311f0ccdd699c0ee9149a7442c46f4f1068b6c899baec8f43523ee079141f29be2dccc79d8bab78acf5122b7831

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\YEIEOE0K\tlauncher[1].xml

Filesize
1KB

MD5
6de6ae04413c717a29c1b1c62527201d

SHA1
94dae8cb2ceb82ed03de37ad37c85d81bd4ea769

SHA256
55afb66c0ad8eef516666e9e9bbb54fc54befefebe6be3c55386ae8ea62c2e31

SHA512
2bb843105ad31cf41d43cf5b03ffd5b1686477dc6d6899ee63c02870f8128b03ead66c39d03c2592a7b8f98f7c35a5e00a34d71564be127781200d7151502eb7

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\YEIEOE0K\tlauncher[1].xml

Filesize
2KB

MD5
440b88e34bdb5baa44b31e93998fc110

SHA1
252fce47e6debf9654fd2adcd5b6635cd22bfc9c

SHA256
88a86555ede1aadb1ea91d1c3fd6e57a054a1ac73d2b256d8666d5f238405141

SHA512
b2d2175979f374409c05a4fa5c57d1b54ed395cffe044c8b5c85edc12a53cf7a5b9640a2afd47695a8f505e38607aa5671a57640acc117717d1c4e03663ece99

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\YEIEOE0K\tlauncher[1].xml

Filesize
1KB

MD5
f08e116ee46e0a52c512306173fe84f1

SHA1
119056d2fbb5f25aa2a39a47e90a46c9b10edbc0

SHA256
46cfc6453f0abf9c5d923932050e3ea8577dd4c2bb988921b21a47904a63300c

SHA512
df9e586251bb1ec560593b5b4b2902ccfad53b8ffe922ba89d96fe9ec9f0bfc323f59aa92cfd44766755348f701a5163f72f566bc5c65bd549a58cc6d1d2204a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\GDCZ9HKP\favicon-32x32[1].png

Filesize
651B

MD5
7913715a81b320876ccb5621784128a4

SHA1
e511f17929effb81fcdc44f836498acc5777e35a

SHA256
5cb742411617f1daf5f20871342d220ae633a6d707f4ba96d54b57f3efe17a7a

SHA512
0edd0a9119b27d63c873a450bcacdbb69d31ceec0de5a2c0d64a3724663e5a9d47d39b38debe4240b90ec7cfbb243469a7b5e857c41d49db6f36fe6aebd61f52

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\KLPJ0VOE\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\TLauncher-2.899-Installer-1.1.5.exe

Filesize
2.2MB

MD5
b0ccb6e5b92c4e60ec3805000575469a

SHA1
92849bcc9caa05d02f65c3e8928f91c37c6cd73e

SHA256
4c336725e93a8c2c20a231a5835a2a6ac8aa14d9ea65a6b84d3871231a73133e

SHA512
4d89ff57379d3cce2bf28aa893fe950dc0ef770ee60be60b7a9e084e5cf99cb68c27bbd435bcc275bf4c39afaea3c02dcdf5258e931f6313a31069bd5544c99e

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\TLauncher-2.899-Installer-1.1.5.exe

Filesize
4.6MB

MD5
00f04b17603227c108f353821a2714df

SHA1
6fb055a2a6d92840d3b493ed99b9463047dc4665

SHA256
13384c7200b16382f058f01c928237a595e818336c8f4b62bb0a7a8e6f814d06

SHA512
cfe308cfd7ff724b439c8997a2abd694d8451e4b1ab873965d9b4de892e64252bdf595f69d00da84bd2f3c77fc32233f83998682af73032bb19956cc2cb2aaec

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\TLauncher-2.899-Installer-1.1.5.exe.yh1egn3.partial

Filesize
24.9MB

MD5
dc18b7f4917cb800b1fa51251bc5b6b3

SHA1
268524e70c51f2f1e0eeb82ef183943aa5285a7c

SHA256
0b1b9037233b62a601b31def961ed5a43773b7407d864c7ad40da9ab9ab91b71

SHA512
e02ace9761c7736175b5a2c2541a51246adc5090c87724962362ec540118b331be1aeffbecd15b469eb4ee0ec29d436cd76b005ef7f7f34cad9084bb2ff03420

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\MPNBHK5U\TLauncher-2.899-Installer-1.1.5[1].exe

Filesize
95KB

MD5
82a945c677efeb6d70802ca3cadd0f81

SHA1
397b52fce94ae69ea778e7bd9ba3cf5d66021334

SHA256
6fe126dce4f4484a43546570d9a502f18df6d7fc72353794f521d234cc9c7b67

SHA512
e881819783039226966e755b38e714ab5ac76a7405e4279d770588a46501270a316ef5ea725ac5e6d9e1259d2aae407a41c9dfe81078e773cca6b5278f434cca

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\200.ico

Filesize
116KB

MD5
e043a9cb014d641a56f50f9d9ac9a1b9

SHA1
61dc6aed3d0d1f3b8afe3d161410848c565247ed

SHA256
9dd7020d04753294c8fb694ac49f406de9adad45d8cdd43fefd99fec3659e946

SHA512
4ae5df94fd590703b7a92f19703d733559d600a3885c65f146db04e8bbf6ead9ab5a1748d99c892e6bde63dd4e1592d6f06e02e4baf5e854c8ce6ea0cce1984f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\BrowserInstaller.exe

Filesize
1.8MB

MD5
cb50d496ae05fa1c8bfbcb3b7f910bfe

SHA1
3ec4d77b73c4d7e9858b11224314e99d082497a8

SHA256
7616c72f6659a3a2439d0452190459cd4ceb83fab2307e3e47c9604fa29d9f34

SHA512
22051de06c7e52a37ad36250aa095a8ccc0b0e1cdbfa2e9073c146e77e278cbdbe89bdb078dcfd8babf48baec1902b303ac39cc9db4114ce1516b06552dc924d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
1.3MB

MD5
bba68732fb535f542f19acd46af00ddf

SHA1
501b7058ce18858a22f6ce198dfc34fff832872d

SHA256
da4577994a0653b6eccea81ecd078397f2088935d24dde5d8de30fbf178dd0e3

SHA512
36b3d68b7163b7be4a12cc9b6fed2136300c8fdc4941e00b42faffe94f40436d104788808d4fcccfb7340e3b4a4bc4740bd66dab840260461a8ecc7785fe43b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

Filesize
326KB

MD5
80d93d38badecdd2b134fe4699721223

SHA1
e829e58091bae93bc64e0c6f9f0bac999cfda23d

SHA256
c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

SHA512
9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd

Filesize
1.7MB

MD5
1bbf5dd0b6ca80e4c7c77495c3f33083

SHA1
e0520037e60eb641ec04d1e814394c9da0a6a862

SHA256
bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b

SHA512
97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd

Filesize
97KB

MD5
da1d0cd400e0b6ad6415fd4d90f69666

SHA1
de9083d2902906cacf57259cf581b1466400b799

SHA256
7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

SHA512
f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

Download Submit
memory/396-0-0x0000029040220000-0x0000029040230000-memory.dmp

Filesize
64KB

Download
memory/396-318-0x0000029047150000-0x0000029047151000-memory.dmp

Filesize
4KB

Download
memory/396-319-0x0000029047160000-0x0000029047161000-memory.dmp

Filesize
4KB

Download
memory/396-35-0x0000029040360000-0x0000029040362000-memory.dmp

Filesize
8KB

Download
memory/396-16-0x0000029040A40000-0x0000029040A50000-memory.dmp

Filesize
64KB

Download
memory/2072-868-0x0000000001070000-0x0000000001458000-memory.dmp

Filesize
3.9MB

Download
memory/2072-1123-0x0000000007080000-0x0000000007083000-memory.dmp

Filesize
12KB

Download
memory/2072-1121-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/2072-1155-0x0000000001070000-0x0000000001458000-memory.dmp

Filesize
3.9MB

Download
memory/4344-263-0x0000028C26B00000-0x0000028C26C00000-memory.dmp

Filesize
1024KB

Download
memory/4344-700-0x0000028C23500000-0x0000028C23502000-memory.dmp

Filesize
8KB

Download
memory/4344-272-0x0000028C24530000-0x0000028C24532000-memory.dmp

Filesize
8KB

Download
memory/4344-759-0x0000028C24280000-0x0000028C24282000-memory.dmp

Filesize
8KB

Download
memory/4344-761-0x0000028C24290000-0x0000028C24292000-memory.dmp

Filesize
8KB

Download
memory/4344-763-0x0000028C24330000-0x0000028C24332000-memory.dmp

Filesize
8KB

Download
memory/4344-765-0x0000028C244B0000-0x0000028C244B2000-memory.dmp

Filesize
8KB

Download
memory/4344-767-0x0000028C244D0000-0x0000028C244D2000-memory.dmp

Filesize
8KB

Download
memory/4344-771-0x0000028C244F0000-0x0000028C244F2000-memory.dmp

Filesize
8KB

Download
memory/4344-273-0x0000028C27980000-0x0000028C27A80000-memory.dmp

Filesize
1024KB

Download
memory/4344-259-0x0000028C24170000-0x0000028C24172000-memory.dmp

Filesize
8KB

Download
memory/4344-267-0x0000028C242D0000-0x0000028C242D2000-memory.dmp

Filesize
8KB

Download
memory/4344-268-0x0000028C26B00000-0x0000028C26C00000-memory.dmp

Filesize
1024KB

Download
memory/4344-265-0x0000028C26B00000-0x0000028C26C00000-memory.dmp

Filesize
1024KB

Download
memory/4344-260-0x0000028C26830000-0x0000028C26930000-memory.dmp

Filesize
1024KB

Download
memory/4344-254-0x0000028C23DD0000-0x0000028C23DD2000-memory.dmp

Filesize
8KB

Download
memory/4344-249-0x0000028C23D80000-0x0000028C23D82000-memory.dmp

Filesize
8KB

Download
memory/4344-245-0x0000028C12B00000-0x0000028C12C00000-memory.dmp

Filesize
1024KB

Download
memory/4344-243-0x0000028C242A0000-0x0000028C242A2000-memory.dmp

Filesize
8KB

Download
memory/4344-229-0x0000028C24130000-0x0000028C24132000-memory.dmp

Filesize
8KB

Download
memory/4344-225-0x0000028C24110000-0x0000028C24112000-memory.dmp

Filesize
8KB

Download
memory/4344-221-0x0000028C240F0000-0x0000028C240F2000-memory.dmp

Filesize
8KB

Download
memory/4344-203-0x0000028C24090000-0x0000028C24092000-memory.dmp

Filesize
8KB

Download
memory/4344-199-0x0000028C24070000-0x0000028C24072000-memory.dmp

Filesize
8KB

Download
memory/4344-189-0x0000028C23750000-0x0000028C23752000-memory.dmp

Filesize
8KB

Download
memory/4344-168-0x0000028C23C40000-0x0000028C23D40000-memory.dmp

Filesize
1024KB

Download