c5451af6287cc48f761b476ae4d1cf7def11ad6482ce63a2bf973f67d4972f25

Analysis

max time kernel
83s
max time network
90s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
11/03/2024, 21:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

download.html
Size

117KB
MD5

0d7adc631c43d54a7902b20a47789c81
SHA1

8e2b0b3ae5c2285a192e024abbb6e3b766160892
SHA256

c5451af6287cc48f761b476ae4d1cf7def11ad6482ce63a2bf973f67d4972f25
SHA512

6226062383e29b4ec6fc4b71737654eccd4945c505a4bc0eef6e864494f650957a553decf39aa025c11b22f67daa797c0a0640f5300b69d0ca1cb3d5e0718dda
SSDEEP

1536:snAltI+SFMN3/yapwzEApQ4iRTTsBFA0gfvQH8mciKyH2H8Lquju8oIER:q+SFM7KzeRQH8tyH2H8WujuZIER

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLsTime\url2 = 0000000000000000	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "124"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = c72807fcf873da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingDelete	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url5 = "https://login.live.com/"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 832067e5f873da01	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.msn.com	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 9e904df4f873da01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\www.bing.com\ = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "16743"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "395205405"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "268435456"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLsTime\url5 = 0000000000000000	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\ServiceTabLoadAttempts = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "395205405"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com\ = "1423"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DomStorageState	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url4 = "https://login.aliexpress.com/"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = a968ace5f873da01	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\DisallowDefaultBrowserPrompt = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\bing.com	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.msn.com\ = "189"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{9F59624A-97B9-451B-A596-EFC26918A485} = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url7 = "https://twitter.com/"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\Total	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\Total = "23"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url3 = "https://www.facebook.com/"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\NumberOfSubdomains = "1"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url3 = "https://login.aliexpress.com/"	MicrosoftEdge.exe

Suspicious behavior: MapViewOfSection 14 IoCs

pid	Process
4220	MicrosoftEdgeCP.exe
4220	MicrosoftEdgeCP.exe
4220	MicrosoftEdgeCP.exe
4220	MicrosoftEdgeCP.exe
4220	MicrosoftEdgeCP.exe
4220	MicrosoftEdgeCP.exe
4220	MicrosoftEdgeCP.exe
4220	MicrosoftEdgeCP.exe
4220	MicrosoftEdgeCP.exe
4220	MicrosoftEdgeCP.exe
4220	MicrosoftEdgeCP.exe
4220	MicrosoftEdgeCP.exe
4220	MicrosoftEdgeCP.exe
4220	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	1688	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1688	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1688	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1688	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3432	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3432	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3432	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3432	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4280	MicrosoftEdge.exe
Token: SeDebugPrivilege	4280	MicrosoftEdge.exe
Token: SeDebugPrivilege	4660	firefox.exe
Token: SeDebugPrivilege	4660	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4660	firefox.exe
4660	firefox.exe
4660	firefox.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4280	MicrosoftEdge.exe
4220	MicrosoftEdgeCP.exe
1688	MicrosoftEdgeCP.exe
4220	MicrosoftEdgeCP.exe
1228	MicrosoftEdgeCP.exe
1228	MicrosoftEdgeCP.exe
1228	MicrosoftEdgeCP.exe
4660	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4220 wrote to memory of 3432	4220	MicrosoftEdgeCP.exe	76
PID 4220 wrote to memory of 3432	4220	MicrosoftEdgeCP.exe	76
PID 4220 wrote to memory of 3432	4220	MicrosoftEdgeCP.exe	76
PID 4220 wrote to memory of 2208	4220	MicrosoftEdgeCP.exe	81
PID 4220 wrote to memory of 2208	4220	MicrosoftEdgeCP.exe	81
PID 4220 wrote to memory of 2208	4220	MicrosoftEdgeCP.exe	81
PID 4220 wrote to memory of 2208	4220	MicrosoftEdgeCP.exe	81
PID 4220 wrote to memory of 2208	4220	MicrosoftEdgeCP.exe	81
PID 4220 wrote to memory of 2208	4220	MicrosoftEdgeCP.exe	81
PID 4220 wrote to memory of 2208	4220	MicrosoftEdgeCP.exe	81
PID 4220 wrote to memory of 2208	4220	MicrosoftEdgeCP.exe	81
PID 560 wrote to memory of 4660	560	firefox.exe	89
PID 560 wrote to memory of 4660	560	firefox.exe	89
PID 560 wrote to memory of 4660	560	firefox.exe	89
PID 560 wrote to memory of 4660	560	firefox.exe	89
PID 560 wrote to memory of 4660	560	firefox.exe	89
PID 560 wrote to memory of 4660	560	firefox.exe	89
PID 560 wrote to memory of 4660	560	firefox.exe	89
PID 560 wrote to memory of 4660	560	firefox.exe	89
PID 560 wrote to memory of 4660	560	firefox.exe	89
PID 560 wrote to memory of 4660	560	firefox.exe	89
PID 560 wrote to memory of 4660	560	firefox.exe	89
PID 4660 wrote to memory of 5056	4660	firefox.exe	90
PID 4660 wrote to memory of 5056	4660	firefox.exe	90
PID 4660 wrote to memory of 4740	4660	firefox.exe	91
PID 4660 wrote to memory of 4740	4660	firefox.exe	91
PID 4660 wrote to memory of 4740	4660	firefox.exe	91
PID 4660 wrote to memory of 4740	4660	firefox.exe	91
PID 4660 wrote to memory of 4740	4660	firefox.exe	91
PID 4660 wrote to memory of 4740	4660	firefox.exe	91
PID 4660 wrote to memory of 4740	4660	firefox.exe	91
PID 4660 wrote to memory of 4740	4660	firefox.exe	91
PID 4660 wrote to memory of 4740	4660	firefox.exe	91
PID 4660 wrote to memory of 4740	4660	firefox.exe	91
PID 4660 wrote to memory of 4740	4660	firefox.exe	91
PID 4660 wrote to memory of 4740	4660	firefox.exe	91
PID 4660 wrote to memory of 4740	4660	firefox.exe	91
PID 4660 wrote to memory of 4740	4660	firefox.exe	91
PID 4660 wrote to memory of 4740	4660	firefox.exe	91
PID 4660 wrote to memory of 4740	4660	firefox.exe	91
PID 4660 wrote to memory of 4740	4660	firefox.exe	91
PID 4660 wrote to memory of 4740	4660	firefox.exe	91
PID 4660 wrote to memory of 4740	4660	firefox.exe	91
PID 4660 wrote to memory of 4740	4660	firefox.exe	91
PID 4660 wrote to memory of 4740	4660	firefox.exe	91
PID 4660 wrote to memory of 4740	4660	firefox.exe	91
PID 4660 wrote to memory of 4740	4660	firefox.exe	91
PID 4660 wrote to memory of 4740	4660	firefox.exe	91
PID 4660 wrote to memory of 4740	4660	firefox.exe	91
PID 4660 wrote to memory of 4740	4660	firefox.exe	91
PID 4660 wrote to memory of 4740	4660	firefox.exe	91
PID 4660 wrote to memory of 4740	4660	firefox.exe	91
PID 4660 wrote to memory of 4740	4660	firefox.exe	91
PID 4660 wrote to memory of 4740	4660	firefox.exe	91
PID 4660 wrote to memory of 4740	4660	firefox.exe	91
PID 4660 wrote to memory of 4740	4660	firefox.exe	91
PID 4660 wrote to memory of 4740	4660	firefox.exe	91
PID 4660 wrote to memory of 4740	4660	firefox.exe	91
PID 4660 wrote to memory of 4740	4660	firefox.exe	91
PID 4660 wrote to memory of 4740	4660	firefox.exe	91
PID 4660 wrote to memory of 4740	4660	firefox.exe	91
PID 4660 wrote to memory of 4740	4660	firefox.exe	91
PID 4660 wrote to memory of 4740	4660	firefox.exe	91
PID 4660 wrote to memory of 4740	4660	firefox.exe	91

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\LaunchWinApp.exe
"C:\Windows\system32\LaunchWinApp.exe" "C:\Users\Admin\AppData\Local\Temp\download.html"
1⤵
PID:1516

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4280

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4056

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4220

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1688

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3432

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1228

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:1980

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:320

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:3096

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:2208

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:2080

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:560
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4660
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4660.0.625773458\127521772" -parentBuildID 20221007134813 -prefsHandle 1688 -prefMapHandle 1680 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fbb39d76-4f92-47aa-8607-32600b34f11b} 4660 "\\.\pipe\gecko-crash-server-pipe.4660" 1764 178764d6858 gpu
    3⤵
    PID:5056
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4660.1.418012903\393507720" -parentBuildID 20221007134813 -prefsHandle 2108 -prefMapHandle 2104 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {86ef2cde-cec7-461e-a9d5-41a6597ca98f} 4660 "\\.\pipe\gecko-crash-server-pipe.4660" 2120 1786b272858 socket
    3⤵
    PID:4740
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4660.2.665577858\1341704565" -childID 1 -isForBrowser -prefsHandle 2796 -prefMapHandle 2692 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2cb2f1ec-12e0-47c1-b60c-416cd4ad9358} 4660 "\\.\pipe\gecko-crash-server-pipe.4660" 2840 1787a4a7058 tab
    3⤵
    PID:2124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4660.3.1110288384\2103040576" -childID 2 -isForBrowser -prefsHandle 2932 -prefMapHandle 2708 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bacf11c5-7ed8-4e8b-a402-f03bb5da328a} 4660 "\\.\pipe\gecko-crash-server-pipe.4660" 3468 1787b213858 tab
    3⤵
    PID:412
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4660.4.100910250\765115198" -childID 3 -isForBrowser -prefsHandle 4324 -prefMapHandle 4328 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {37577090-c0b9-407e-9a77-e5145c261d96} 4660 "\\.\pipe\gecko-crash-server-pipe.4660" 4240 1787c490658 tab
    3⤵
    PID:4200
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4660.5.1179265068\782260837" -childID 4 -isForBrowser -prefsHandle 4804 -prefMapHandle 4800 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ee2f9917-0a08-414e-be79-cfe32ef3bcf0} 4660 "\\.\pipe\gecko-crash-server-pipe.4660" 4812 1787c654558 tab
    3⤵
    PID:1484
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4660.6.648838\2135706208" -childID 5 -isForBrowser -prefsHandle 4952 -prefMapHandle 4956 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {19531547-ddc9-4fbb-a19c-a29f91f36abb} 4660 "\\.\pipe\gecko-crash-server-pipe.4660" 5036 1787c95e358 tab
    3⤵
    PID:3036
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4660.7.1360001985\1259431216" -childID 6 -isForBrowser -prefsHandle 5148 -prefMapHandle 5152 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d49ea7aa-a6cc-4a62-a10d-ee22418dac4f} 4660 "\\.\pipe\gecko-crash-server-pipe.4660" 5140 1787c95f258 tab
    3⤵
    PID:4512
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4660.8.1742904198\1455589918" -childID 7 -isForBrowser -prefsHandle 4800 -prefMapHandle 4384 -prefsLen 26424 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {209b1691-c3c7-418d-a59f-dedb3c9e2ba0} 4660 "\\.\pipe\gecko-crash-server-pipe.4660" 4404 1786b25e858 tab
    3⤵
    PID:2596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\U2DI4E2V\edgecompatviewlist[1].xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\25X9ER6P\warmup[2].gif

Filesize
43B

MD5
325472601571f31e1bf00674c368d335

SHA1
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a

SHA256
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

SHA512
717ea0ff7f3f624c268eccb244e24ec1305ab21557abb3d6f1a7e183ff68a2d28f13d1d2af926c9ef6d1fb16dd8cbe34cd98cacf79091dddc7874dcee21ecfdc

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
4KB

MD5
1bfe591a4fe3d91b03cdf26eaacd8f89

SHA1
719c37c320f518ac168c86723724891950911cea

SHA256
9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8

SHA512
02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!002\MicrosoftEdge\Cache\9V100A5P\otBannerSdk[1].js

Filesize
426KB

MD5
9407efa17b9fa09288ff833eeb111cc7

SHA1
4fba1d46d43eeaeff48b8493245e5cda953285c8

SHA256
9cfaaf4e24c9a20159123c632711d2cbb98854a66ab659a5c24373633f180d4a

SHA512
f864566e20f37099463b4bb39665a52293402d293f9bdbccdac3b6cda7db41f91ce79c34786129f84c822f2c35a7a0976060fcd97271dd27685e4f6255f70b0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!002\MicrosoftEdge\Cache\9V100A5P\otTCF[2].js

Filesize
38KB

MD5
ccc7bdfd4fec43bb4e2ee254705af6f9

SHA1
9a2a188ff810fd0f025266d2b65f448a5ca84181

SHA256
0881d43075354250e7ca66af2628b7f894bca339f73be5add8c16e166d253708

SHA512
93e7b2cf7c54dda5bacede673dee2829335642aca27eb36afc4a117ee38e00bbc2ee801d751c7af5cbd1c31d0fb92643a862ca710f243e4e9fe64027fa0e39b0

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!002\MicrosoftEdge\Cache\ZWE9CPLA\otSDKStub[2].js

Filesize
23KB

MD5
04a736599abd9d35460f225bdd4d2c6b

SHA1
f3a6c5e12a6862451d6a457230a506ce0dbd4007

SHA256
8dab3ce341beacb7483049495e317f00aad8ec7d960f98f2619536fb8f2f75f1

SHA512
a30d77969ff900e42f743bbbc44ff76a7c6abfba0641ebba1e8e93df72e8b232b774daa105252ecf52042bc6a995bbce17f9e91b2343f844776adc40967adccc

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!002\MicrosoftEdge\User\Default\DOMStore\0PH9T4IA\www.bing[1].xml

Filesize
2KB

MD5
05f7055a18edb147620491f116be4c9e

SHA1
a6491a587419554cc07f4907b00de33d94d2b46c

SHA256
bae56e5ef291cfc91b5b0eafbd1271b0418551d33f06eae650d96fd3442eb42a

SHA512
9fbf9e8069d4e4eb1fb9feb577e7eb7ca97f3d1f255afb58b43a51509e087cdca7c60d9834fb305ca69606cbc67881b3072f2bc76a24dd9ef40f8409d8a48feb

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!002\MicrosoftEdge\User\Default\DOMStore\KL63SLHK\www.msn[1].xml

Filesize
485B

MD5
7e6af01fec51fbf4fd1ec30aa7872236

SHA1
be8a5989a71d71a133f0627d2e4bd93b1ff54353

SHA256
c7d5d62717ec4ba9ff123a2f69bb72174bb9f566dd4c4620f5b8d6bda9db18d7

SHA512
a056de4962fe64bc9e7bc69954ee6d21495f668927ff6009a8db11e22999fa7e8dab1b959816be37fb905f73bc9208d5d6dd60ae2aa0f82f2b70afc9a3c18ab4

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\KHJBVU9U\favicon[1].ico

Filesize
1KB

MD5
205bbb2aabbf6df9290da61026a3f6f2

SHA1
4f21bf0657e6ec6427ebf8145139c855863c2099

SHA256
69c03ffd2ac94497289f61e7cb55e9fe34eaf7b67dc7a7aebb075dbcfca4470b

SHA512
d4539cd9e4fbb594dc95f9cf3dc35f35a39155327e6eb2149ec45b5d0e9581f62392cdeba446c29fb295995609ace51028903c89ecb42b0a5d759fc7714e5502

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DFB124D2227279E5B2.TMP

Filesize
20KB

MD5
c76092fcbb905028a0384a3b85c7a9eb

SHA1
8504a87bbbd5e518c1f99da3285a9bc441ac08e8

SHA256
c87d38136f87c621820a4577e53ff9466ab01126778b7597d4e12ce518e893c7

SHA512
80ab3e968be0a9c52befadb4369299aa5b4664819948431085d6a4def110b40b15ce2ca7817f4fdee90190e2d52454da2960dc9e6dddfd28f43d11f4059227ee

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0htfzopy.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
00c32612a7d3d158a6ef5b48898d7e79

SHA1
0a5627587fdd5e06cc705608297e4d1467f8eb30

SHA256
e419937d98961a024d3c46f132ab9fb7523a29adcae818dd87a36a4cfbcb5321

SHA512
b6f5c417a6b49007eca5a5365ec22768ba15f98e6a49dbc6668e3eca3793fed4c73725309cc650a68bfa33cf51b44cf4769dc4146089c4b86c25149ba0290ace

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0htfzopy.default-release\datareporting\glean\pending_pings\96cd6924-e72b-49f4-9d73-9cb77bac5ae7

Filesize
746B

MD5
1486fff2e44b2033b009d8e47329a19b

SHA1
90477de895dec2529232d525abaec086cd67dab1

SHA256
c4e0e7490c226238fdeaf927620dc95bc43162ebde62b98b126b91f37c25e360

SHA512
37078c87e6bc2eab04bbbbaf31bc4ea400f6bef9eaefb492a29cba6de457dea9f30c5bf8222fc79a2b7a247141c6f510d43ab8af9a8998893ef1561e7add4b24

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0htfzopy.default-release\prefs.js

Filesize
6KB

MD5
20e7af9c25aa92036f5207285d21bd73

SHA1
6d154616ccc6bcdb897ec38fe7961364380647d2

SHA256
171450dc3b2043d6e51a943c918a4a4d4c9830ea82786ce1a4da4a06cdd4c727

SHA512
71544820498a5e9e6ab005a3efca5517dd69c287b0a6a7457af14a3c2bde59d09cb730ff0dbe699fdd08a524306e04aa8ee3683f4fb63a8965aed1d372508183

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0htfzopy.default-release\prefs.js

Filesize
6KB

MD5
f4160b42bb0c2a5fcef9a7a2d09ebd3a

SHA1
c5772dc8a8412d9f49497e155a39adfd0d762ef9

SHA256
ea811f4828138457bb3addc32dec52cb749c6ec1af8a9e398e87e5215ba23984

SHA512
94ec078136d946e37c51e87794ab0136799c98498faf066c26e0e249c8831a0ef88ef3420e1381cf39c5e95e824c53e0f951f6d11c5041f20f47dd9b127ebd24

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0htfzopy.default-release\prefs.js

Filesize
6KB

MD5
163f2b6be781d05ce4653d6fd88f6f39

SHA1
38fb3a56f61296a98f6d4773f057af777d2df82d

SHA256
6b89ce45c4c81341a67d9e23a5750879e2807e306dd4e19f26a0afd5fda50eeb

SHA512
c1f12b4e4f0265a2b31c7eced57641c7b5b154649de81c517e3e55141b4060f13515edd5485211617125bcb16580a85d28f581c607cc34ab64d36c5aaa919230

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0htfzopy.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
3bcdef0c4aab58f3f5ce81581ac3b709

SHA1
be995bbf03570c8339de680d06f7c821c6fbf2bf

SHA256
96527d21e5cc99e7b2ad756847e5b6df692edbe13d0f37c84cabd0e90b2c804b

SHA512
cfbec5e4781a5059a5f24167bacd9f3c620b2c3c453e0919118aac3b073e74861d2b54141981436ef45e7f5819db92b524d40fdd3595836999a7904b2ff3ce6c

Download Submit
memory/1228-224-0x000001E67F580000-0x000001E67F680000-memory.dmp

Filesize
1024KB

Download
memory/1228-449-0x000001E67CA70000-0x000001E67CA80000-memory.dmp

Filesize
64KB

Download
memory/1228-435-0x000001E67CA70000-0x000001E67CA80000-memory.dmp

Filesize
64KB

Download
memory/1228-433-0x000001E67CA70000-0x000001E67CA80000-memory.dmp

Filesize
64KB

Download
memory/1228-437-0x000001E67CA70000-0x000001E67CA80000-memory.dmp

Filesize
64KB

Download
memory/1228-439-0x000001E67CA70000-0x000001E67CA80000-memory.dmp

Filesize
64KB

Download
memory/1228-440-0x000001E67CA70000-0x000001E67CA80000-memory.dmp

Filesize
64KB

Download
memory/1228-441-0x000001E67CA70000-0x000001E67CA80000-memory.dmp

Filesize
64KB

Download
memory/1228-442-0x000001E67CA70000-0x000001E67CA80000-memory.dmp

Filesize
64KB

Download
memory/1228-443-0x000001E67CA70000-0x000001E67CA80000-memory.dmp

Filesize
64KB

Download
memory/1228-445-0x000001E67CA70000-0x000001E67CA80000-memory.dmp

Filesize
64KB

Download
memory/1228-444-0x000001E67CA70000-0x000001E67CA80000-memory.dmp

Filesize
64KB

Download
memory/1228-446-0x000001E67CA70000-0x000001E67CA80000-memory.dmp

Filesize
64KB

Download
memory/1228-447-0x000001E67CA70000-0x000001E67CA80000-memory.dmp

Filesize
64KB

Download
memory/1228-448-0x000001E67CA70000-0x000001E67CA80000-memory.dmp

Filesize
64KB

Download
memory/1228-133-0x000001E67DBF0000-0x000001E67DC10000-memory.dmp

Filesize
128KB

Download
memory/1228-450-0x000001E67CA70000-0x000001E67CA80000-memory.dmp

Filesize
64KB

Download
memory/1228-451-0x000001E67CA70000-0x000001E67CA80000-memory.dmp

Filesize
64KB

Download
memory/1228-420-0x000001E67CA70000-0x000001E67CA80000-memory.dmp

Filesize
64KB

Download
memory/1228-418-0x000001E67CA70000-0x000001E67CA80000-memory.dmp

Filesize
64KB

Download
memory/1228-336-0x000001DE20720000-0x000001DE20740000-memory.dmp

Filesize
128KB

Download
memory/1228-232-0x000001DE21420000-0x000001DE21440000-memory.dmp

Filesize
128KB

Download
memory/1228-195-0x000001E67DCB0000-0x000001E67DCD0000-memory.dmp

Filesize
128KB

Download
memory/1228-222-0x000001E67F440000-0x000001E67F460000-memory.dmp

Filesize
128KB

Download
memory/2208-429-0x000001E094E00000-0x000001E094E02000-memory.dmp

Filesize
8KB

Download
memory/3432-69-0x00000175FAC20000-0x00000175FAC22000-memory.dmp

Filesize
8KB

Download
memory/3432-67-0x00000175FAB60000-0x00000175FAB62000-memory.dmp

Filesize
8KB

Download
memory/3432-65-0x00000175FAB40000-0x00000175FAB42000-memory.dmp

Filesize
8KB

Download
memory/4280-0-0x000001AEAB520000-0x000001AEAB530000-memory.dmp

Filesize
64KB

Download
memory/4280-35-0x000001AEAB8B0000-0x000001AEAB8B2000-memory.dmp

Filesize
8KB

Download
memory/4280-16-0x000001AEABE00000-0x000001AEABE10000-memory.dmp

Filesize
64KB

Download