Overview
overview
4Static
static
1URLScan
urlscan
1https://grabify.link...
windows10-2004-x64
1https://grabify.link...
windows10-1703-x64
4https://grabify.link...
windows7-x64
1https://grabify.link...
windows10-2004-x64
1https://grabify.link...
windows11-21h2-x64
1https://grabify.link...
android-10-x64
1https://grabify.link...
android-10-x64
1https://grabify.link...
android-11-x64
1https://grabify.link...
android-13-x64
1https://grabify.link...
android-9-x86
1https://grabify.link...
macos-10.15-amd64
4https://grabify.link...
macos-10.15-amd64
4https://grabify.link...
ubuntu-24.04-amd64
1https://grabify.link...
debian-12-armhf
https://grabify.link...
debian-12-mipsel
https://grabify.link...
debian-9-armhf
https://grabify.link...
debian-9-mips
https://grabify.link...
debian-9-mipsel
https://grabify.link...
ubuntu-18.04-amd64
3https://grabify.link...
ubuntu-20.04-amd64
4https://grabify.link...
ubuntu-22.04-amd64
1https://grabify.link...
ubuntu-24.04-amd64
1Analysis
-
max time kernel
1799s -
max time network
1608s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
12-06-2024 07:13
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://grabify.link/58KGVG
Resource
win10v2004-20240611-en
Behavioral task
behavioral2
Sample
https://grabify.link/58KGVG
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
https://grabify.link/58KGVG
Resource
win7-20240419-en
Behavioral task
behavioral4
Sample
https://grabify.link/58KGVG
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
https://grabify.link/58KGVG
Resource
win11-20240611-en
Behavioral task
behavioral6
Sample
https://grabify.link/58KGVG
Resource
android-x64-20240611.1-en
Behavioral task
behavioral7
Sample
https://grabify.link/58KGVG
Resource
android-x64-20240611.1-en
Behavioral task
behavioral8
Sample
https://grabify.link/58KGVG
Resource
android-x64-arm64-20240611.1-en
Behavioral task
behavioral9
Sample
https://grabify.link/58KGVG
Resource
android-33-x64-arm64-20240611.1-en
Behavioral task
behavioral10
Sample
https://grabify.link/58KGVG
Resource
android-x86-arm-20240611.1-en
Behavioral task
behavioral11
Sample
https://grabify.link/58KGVG
Resource
macos-20240611-en
Behavioral task
behavioral12
Sample
https://grabify.link/58KGVG
Resource
macos-20240611-en
Behavioral task
behavioral13
Sample
https://grabify.link/58KGVG
Resource
ubuntu2404-amd64-20240523-en
Behavioral task
behavioral14
Sample
https://grabify.link/58KGVG
Resource
debian12-armhf-20240221-en
Behavioral task
behavioral15
Sample
https://grabify.link/58KGVG
Resource
debian12-mipsel-20240418-en
Behavioral task
behavioral16
Sample
https://grabify.link/58KGVG
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral17
Sample
https://grabify.link/58KGVG
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral18
Sample
https://grabify.link/58KGVG
Resource
debian9-mipsel-20240418-en
Behavioral task
behavioral19
Sample
https://grabify.link/58KGVG
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral20
Sample
https://grabify.link/58KGVG
Resource
ubuntu2004-amd64-20240508-en
Behavioral task
behavioral21
Sample
https://grabify.link/58KGVG
Resource
ubuntu2204-amd64-20240611-en
Behavioral task
behavioral22
Sample
https://grabify.link/58KGVG
Resource
ubuntu2404-amd64-20240523-en
General
-
Target
https://grabify.link/58KGVG
Malware Config
Signatures
-
Drops file in Windows directory 6 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exedescription ioc process File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdge.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe -
Processes:
browser_broker.exeMicrosoftEdgeCP.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe -
Modifies registry class 64 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 3cd0ca1798bcda01 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$vBulletin 4 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\NextPromptBuild = "15063" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CTLs MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 4a5ac91198bcda01 MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames\ MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B7216 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "395205405" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "268435456" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CRLs MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\CTLs MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData\RulesFileNextUpdateDate = "424338447" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 5c87491698bcda01 MicrosoftEdge.exe -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
MicrosoftEdgeCP.exepid process 4744 MicrosoftEdgeCP.exe 4744 MicrosoftEdgeCP.exe 4744 MicrosoftEdgeCP.exe 4744 MicrosoftEdgeCP.exe 4744 MicrosoftEdgeCP.exe 4744 MicrosoftEdgeCP.exe 4744 MicrosoftEdgeCP.exe 4744 MicrosoftEdgeCP.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
MicrosoftEdgeCP.exedescription pid process Token: SeDebugPrivilege 592 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 592 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 592 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 592 MicrosoftEdgeCP.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exepid process 600 MicrosoftEdge.exe 4744 MicrosoftEdgeCP.exe 592 MicrosoftEdgeCP.exe 4744 MicrosoftEdgeCP.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
MicrosoftEdgeCP.exedescription pid process target process PID 4744 wrote to memory of 1584 4744 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4744 wrote to memory of 1584 4744 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4744 wrote to memory of 1584 4744 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4744 wrote to memory of 2376 4744 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4744 wrote to memory of 2376 4744 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4744 wrote to memory of 2376 4744 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4744 wrote to memory of 2376 4744 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4744 wrote to memory of 2376 4744 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4744 wrote to memory of 2376 4744 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe
Processes
-
C:\Windows\system32\LaunchWinApp.exe"C:\Windows\system32\LaunchWinApp.exe" "https://grabify.link/58KGVG"1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VSH5XF98\edgecompatviewlist[1].xmlFilesize
74KB
MD5d4fc49dc14f63895d997fa4940f24378
SHA13efb1437a7c5e46034147cbbc8db017c69d02c31
SHA256853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1
SHA512cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\4QQNSJPZ\suggestions[1].en-USFilesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\2DNTHEMS\intersection-observer.min[1].jsFilesize
5KB
MD5e02d881229f4e5bcee641ed3a2f5b980
SHA129093656180004764fc2283a6565178eb91b5ef3
SHA2568037c1f1e0e4d3d7955f591a14a4b4d090141f1d210ef8b793ce5b345f08f7f5
SHA512f4e8e21b91ee33879a2295215cba91e12851891165fe3f9f98913022280ef8192fd3f5def06aa8ac1fbe6d43d09034b0bb8e29e8703366a012e1fde6ff2828db
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\2DNTHEMS\www-i18n-constants[1].jsFilesize
5KB
MD5877a2b1590385d79323ef992abe9e961
SHA1f2f65882785537d6f3eeba7f02ea233f9e55672f
SHA256ff474db3ea4409f034cbae6ae738bc80fb18734ccd38f87fcde90d02e11cfac3
SHA512c7b9bda266c59a19476d7eaa3f6bc10d8d916345ff4195ee5932f5d5d884a487407552a29d576a9dd53dfd2588069c7376f660800f5ab7f8e1bea78cdd146e14
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\2DNTHEMS\www-onepick[1].cssFilesize
739B
MD59ace9ca4e10a48822a48955cbd3f94d0
SHA11f0efa2ee544e5b7a98de5201fb8254b6f3eb613
SHA256f8fdbb9c5cdceb1363bb04c5e89b3288ea30d79ef1a332e7a06c7195dd2e0ec4
SHA51225354aeecb224fd6d863c0253cd7ad382dce7067f4147790ee0ce343f8c3e0efb84e54dd174116e7ad52d4a7e05735039fa1085b739abbe80f9e318e432eed73
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\9ZOAZUWB\css2[1].cssFilesize
2KB
MD55912f3bba71c222672dfa244a60acef0
SHA1317a49729bb8654c3986e6b32278258a1d692d81
SHA25648708ab3b01bc53a736f7f85e0badd9174872faa981e78b32c16c4efcaa59d99
SHA512770f13af0d6ebe7ff9d925efccd05b0b2e5afd5fbe19770562d88936d541a298a49aea028f5122a255fb5026b4a5f37c0cf52831212ecaaf378a5769ff0379f7
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\9ZOAZUWB\scheduler[1].jsFilesize
9KB
MD5782c6d90c35e8205e0d59f6455820342
SHA1448c390e25d48b787b71753f13856385cd1a10b8
SHA2563cf56fb5fd8de09d2f6e66334243f1e3a1708c315ba0aa9f0c16de1d0f099e17
SHA5126d5fed9cbdfcf61c35a4ac38fe4486065d5784154fb85597d3fd0a45b4861ac6dea3f6e2604ba44af7302eafe8b7154b6070d65f44974b922327cfecba9528a4
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\KKENGRF2\webcomponents-ce-sd[1].jsFilesize
95KB
MD58a3c79faed4aafeb6f033759270f4009
SHA12c5d1a5ccd7b4378a98e29d6c1a9a513fd700b77
SHA256ef2634fa681d36decb5bed34ec4a9e7d330de160020e2d7566273e71284993c1
SHA512a40a76b91a30626488848eb40a9b95ddc4e880574b1cdbda8dd397f4fac25c2315e95e2851b81210b6263529250e9b7f5780d1f796a603a9658a7e15d19b5a71
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\KKENGRF2\www-main-desktop-watch-page-skeleton[1].cssFilesize
8KB
MD564c8e3b11cfffc8ebf2240e4f46ab492
SHA171276680811731f983502e477a87e87cfe72d75f
SHA2563acc199c41eb3c884ee9884c15e6b78975499be2255aa203dba38ef24440181c
SHA512497a48233bb198e05517e2cba003c2c5ba25183e1654b5b8252b9823f0859497ccab66a77e243238b27ea6eb826ae4fc72efb2f32b2b378edee7f9dfb87f4756
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\KKENGRF2\www-player[1].cssFilesize
371KB
MD569958caec43c10f1d36a71ce83ac69e8
SHA1d363274a0f568e4bfe98e978eae59441fc17a1fa
SHA256d24493147c49a7b5d1a21c66aa87d11a0c976cd4e9392b89add880139aa2b1ff
SHA5128a57bb5c5a1f7a91057493bad34133f7a2da0b7322ea84638a82e4df13045a584b11a0bc5beb90c018e9d5fecd323bc73cb35e2c322804ddd74ab0e4967bb84a
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\REES9JN5\rs=AGKMywFNL9vtM4qXRAfLj5XzdM6jIwCXQw[1].cssFilesize
2.8MB
MD5af02bb33965b26a5619bbf0ae825f681
SHA1dc570fa479b186554b550e41c9bcb4d655a40fc4
SHA25686dc8fc3db891e31041992d179094b0d8045aab1b3258dbb9dc9e9cecdb9048d
SHA5125bb65df2d29e6b1c8aee0f9cd9e9caec93862fa2ee0cc6c0fb64f6c2d7961fb61cb4abfb97d98bbcae2a7e2e415acbcacfbdd8eacb910ca88539d0a44bcc4201
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\REES9JN5\web-animations-next-lite.min[1].jsFilesize
49KB
MD55ab6c49dc7432d357d58fa452be3bff0
SHA1b818a372657035d83161a32d42db3503b8d64b77
SHA2562a39e309723372fa708ad44312f539e86defc91f28fd36e71a44e3b59c36537c
SHA51233fa611bdde181cf1db7ffffaea01eb1cea240b08b0ee8c9141edc84dabaed419049f78223b305a3ac4c0d2d047971a917bfd2a0215c8845aea9752ca3321745
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\REES9JN5\www-main-desktop-player-skeleton[1].cssFilesize
2KB
MD52a5f27d8d291d864d13eaa1f5cd9cd51
SHA1b39f9b99b924e5251ac48fad818d78999cfd78d4
SHA256056232b6127143e2f8bf4218db355d978e1e96f5dedcce59a9f5d6ab92b437f1
SHA5121b54f1e13cb38e41f2a65db3cdc2bc702a9e963751b1ef0338d67b95816441b0143e1d4dabc99f276a04f9c00570bb8933f1bd87394998b3878c268b08ecf24a
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAFilesize
1KB
MD5962debf6fda6f65f06a5df811f4a7407
SHA1f6257069f9287554248fb2e067271b77ac9a7136
SHA256d57f0a30d35d94a2697ba14ea6bb57f2ad52b4b612a8fa5f37ec31cf08e40e6a
SHA5128bd8b1e5d0a3995ec7bbd1a69b01c0c97d9cb436d803ebc91f691d0a91cb3ba429edc588de9d33bf2d2dc5dc2a1ce27f572989f24cf378d58480bad856af0074
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_5E390E1CA50E646B1021D6CAA485D322Filesize
471B
MD5e6868114550f22eb84a50b078bda483d
SHA19304e0f07a02f36a9624dd43e3e5f6e3a8423b1f
SHA2560265d5c043ab007adb15f48b2af9a09b691af3b80b78ddcf24b1b915c94690d0
SHA5127f69f27595759bf043ff75d48980606fb2746ae47696002616dd3fefce194b68651325106e643a93c0b67fbba8dea7e86377b7b8f0f6051d8356a095b858db9e
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_253AFFEBDDD932C2C90532345D896F24Filesize
471B
MD50578dfe9c55a28c791a908e613c1c5a3
SHA19697c6b1e3a85c0a005e785c75fbb3c2a4c93007
SHA256350fa579f4d34b3f9bbac52bef3680fb3e0153c5bbc258f1bdf60d6f8cc42b0a
SHA512423748dfe83dd1a75fe2be0bf6667be1d7bff63f3e4b46102e1f82c4b3058a397de5e62c083aa47cef1c7f1423f78ce452d8bd06d3ea245a3f49d405418e8c42
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_89FBEB9EEBFF8AABF1EBFA20B87AFE7EFilesize
471B
MD563f919430d6d80532fc1f4c69921ca85
SHA1ce7298b0f54e177293684d2f5504f6129ec48bb8
SHA256216e6253db4164f244ac5b1a2e41dc5560dc6d7f744294925aa2e79be6c395aa
SHA512d74d7e0a5bc736b0be07e0588b34d655d3dcfb9d39a1b69a87290c0b8607cf1efec1b67dd19e4ec15c8f1541e0eaed9cd56800ddb417e3f10e01d2fbe447a9c1
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAFilesize
724B
MD5ac89a852c2aaa3d389b2d2dd312ad367
SHA18f421dd6493c61dbda6b839e2debb7b50a20c930
SHA2560b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45
SHA512c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAFilesize
410B
MD59b09bb39ed037f898cfdcf407baff4cb
SHA10c140536614badd7213e5edebf5a4645a9404077
SHA256bc7db4bbf270ef110662cc18582af4c664c58e8f188d5f4269a20818c5a4c3ab
SHA51221a4ecf3430d9e33d34b72174ee3cdeeabd2966fe09b407eee9c816a8a0056d98fe293af0a32c9fd921b1e7db44113aa5be989c0e9ac847e917053ac311367c9
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_5E390E1CA50E646B1021D6CAA485D322Filesize
406B
MD5328bf5c7e4e6535bb7b7737611d96a0f
SHA10ce7e4955d5703b908f96b5c7eec15a5cebfd235
SHA256ff580940b9dde7ca153a1be55cc00cb7f8af6cc1eafcb88712bd1b9434b0841a
SHA512909e9d6df7f54a8005c90e7b3493a7e6ab7eae301978a006c5483514e260e4f1b7d5948f91e705cd34b2fc5ef5c64a80c7863c45cf61b0a1e5ea761eca276d34
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_253AFFEBDDD932C2C90532345D896F24Filesize
414B
MD5ffea073fe9b47688abe823bed88034aa
SHA1034fae3e7139ecbd863b5d2e0d7dec66627bfc35
SHA256424fd1e8243f4eac56926b725e2c0f457902773617a8d401e946403829a378c4
SHA512c27efc92337e48080580bdd7e6e72d5bcb93cb5db780ccc27fc2f7c45ed31893db079e550303f466a61256e350e111b8a9859fb2b6f1c2376fd055663edbf09a
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_89FBEB9EEBFF8AABF1EBFA20B87AFE7EFilesize
406B
MD5e4a9080a98195e00577cd4110ab7fed1
SHA1b74786f1ec772537dbd1c2a80eaf45f9430d9c48
SHA2561ba71b0cc4d43e4b89896fde41e6d3b36730304616219302a0fdcee5381951db
SHA512ca16d5fac4ccec199f86ba34399e28387ee0032c5e6c6cc865efa591ec29624532000e099ce225d114e54ffcf876e3be25b2b9bf4362b5b38c8a54c06e897465
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAFilesize
392B
MD5d657fd6c1f3efd4c7269f8c3c29169fa
SHA1006c71d22a612c084c56360819396864b2c23288
SHA2562fc6e732ad365524d231390a2f0423f2e8dbd12e8e626e7b3ca93f32a6d09498
SHA512e354a4d4d45b0043dc633a11852c9f73d92ed542f9a512ea0c0132574841f0a00305cf881cff128871e2262265bc27d11c2a3a6a46d719f927c5385de9c86fbd
-
memory/592-44-0x0000012C06600000-0x0000012C06700000-memory.dmpFilesize
1024KB
-
memory/592-42-0x0000012C06600000-0x0000012C06700000-memory.dmpFilesize
1024KB
-
memory/600-16-0x000001D54D720000-0x000001D54D730000-memory.dmpFilesize
64KB
-
memory/600-0-0x000001D54D620000-0x000001D54D630000-memory.dmpFilesize
64KB
-
memory/600-227-0x000001D555B10000-0x000001D555B11000-memory.dmpFilesize
4KB
-
memory/600-226-0x000001D555B00000-0x000001D555B01000-memory.dmpFilesize
4KB
-
memory/600-35-0x000001D54C8B0000-0x000001D54C8B2000-memory.dmpFilesize
8KB
-
memory/1584-75-0x00000267A7120000-0x00000267A7122000-memory.dmpFilesize
8KB
-
memory/1584-68-0x0000026796B00000-0x0000026796C00000-memory.dmpFilesize
1024KB
-
memory/1584-69-0x0000026796B00000-0x0000026796C00000-memory.dmpFilesize
1024KB
-
memory/1584-73-0x00000267A7100000-0x00000267A7102000-memory.dmpFilesize
8KB
-
memory/1584-80-0x00000267A73A0000-0x00000267A73A2000-memory.dmpFilesize
8KB
-
memory/1584-96-0x00000267A7320000-0x00000267A7340000-memory.dmpFilesize
128KB
-
memory/2376-195-0x000002032BFC0000-0x000002032C0C0000-memory.dmpFilesize
1024KB
-
memory/2376-197-0x000002032BFC0000-0x000002032C0C0000-memory.dmpFilesize
1024KB
-
memory/2376-206-0x000002033C6E0000-0x000002033C6E2000-memory.dmpFilesize
8KB
-
memory/2376-202-0x000002032BF40000-0x000002032BF42000-memory.dmpFilesize
8KB
-
memory/2376-196-0x000002032BFC0000-0x000002032C0C0000-memory.dmpFilesize
1024KB
-
memory/2376-200-0x000002032BF20000-0x000002032BF22000-memory.dmpFilesize
8KB
-
memory/4772-181-0x000001F2C19A0000-0x000001F2C19C0000-memory.dmpFilesize
128KB