880c660c294b6a8cecfd83182de82154b75ae2fcd723d34bd498e05771a2efb2

Resubmissions

02-07-2024 05:30

240702-f7gzaayakh 10

02-07-2024 05:27

240702-f5tv3axhna 9

02-07-2024 05:22

240702-f2njwa1gnq 9

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
02-07-2024 05:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Heist Editor.exe
Size

7.7MB
MD5

2324a543219161cd967a7c62595ab445
SHA1

c5cb01869eb85be735592d20f584ce478e868624
SHA256

880c660c294b6a8cecfd83182de82154b75ae2fcd723d34bd498e05771a2efb2
SHA512

47a28ccb2285ef4eb4956e820049a2725c786a36bf9bec8e755ce414899e9540e8df1ebd5d715e2863fe2d447d701044391149b0edfe9b4c8b0316e0078a8173
SSDEEP

196608:Su0t9MU87PZx1xYeMJhM0m7vWMBu6xi6HV5n:SuEAPZFYeMJhM0m7rPk6H7

Score

9^/10

evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

Heist Editor.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Heist Editor.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Heist Editor.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Heist Editor.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Heist Editor.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Heist Editor.exe

Themida packer 16 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral2/memory/1748-0-0x00007FF73DA40000-0x00007FF73ED16000-memory.dmp	themida
behavioral2/memory/1748-3-0x00007FF73DA40000-0x00007FF73ED16000-memory.dmp	themida
behavioral2/memory/1748-4-0x00007FF73DA40000-0x00007FF73ED16000-memory.dmp	themida
behavioral2/memory/1748-5-0x00007FF73DA40000-0x00007FF73ED16000-memory.dmp	themida
behavioral2/memory/1748-2-0x00007FF73DA40000-0x00007FF73ED16000-memory.dmp	themida
behavioral2/memory/1748-6-0x00007FF73DA40000-0x00007FF73ED16000-memory.dmp	themida
behavioral2/memory/1748-7-0x00007FF73DA40000-0x00007FF73ED16000-memory.dmp	themida
behavioral2/memory/1748-9-0x00007FF73DA40000-0x00007FF73ED16000-memory.dmp	themida
behavioral2/memory/1748-8-0x00007FF73DA40000-0x00007FF73ED16000-memory.dmp	themida
behavioral2/memory/1748-10-0x00007FF73DA40000-0x00007FF73ED16000-memory.dmp	themida
behavioral2/memory/1748-18-0x00007FF73DA40000-0x00007FF73ED16000-memory.dmp	themida
behavioral2/memory/1748-20-0x00007FF73DA40000-0x00007FF73ED16000-memory.dmp	themida
behavioral2/memory/1748-22-0x00007FF73DA40000-0x00007FF73ED16000-memory.dmp	themida
behavioral2/memory/1748-27-0x00007FF73DA40000-0x00007FF73ED16000-memory.dmp	themida
behavioral2/memory/1748-29-0x00007FF73DA40000-0x00007FF73ED16000-memory.dmp	themida
behavioral2/memory/1748-31-0x00007FF73DA40000-0x00007FF73ED16000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

Heist Editor.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Heist Editor.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

Heist Editor.exe

pid process

1748 Heist Editor.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Heist Editor.exe

pid	process
1748	Heist Editor.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe

Modifies registry class 47 IoCs

Processes:

explorer.exemsedge.exemsedge.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WFlags = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616209"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 7800310000000000cb58ac941100557365727300640009000400efbe874f7748e2587c2b2e000000c70500000000010000000000000000003a0000000000ec41130055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\ShowCmd = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 5000310000000000e258822b100041646d696e003c0009000400efbecb58ac94e258822b2e00000078e10100000001000000000000000000000000000000e34cd300410064006d0069006e00000014000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4204450073-1267028356-951339405-1000\{53845631-61CF-4904-BCA2-C71737BE67AF}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\HotKey = "0"	explorer.exe

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

notepad.exe

pid process

4648 notepad.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

explorer.exe

pid process

3824 explorer.exe

pid	process
4648	notepad.exe

pid	process
3824	explorer.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exe

pid	process
3880	msedge.exe
3880	msedge.exe
5048	msedge.exe
5048	msedge.exe
2912	identity_helper.exe
2912	identity_helper.exe
4592	msedge.exe
4592	msedge.exe
4500	msedge.exe
4500	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

Processes:

msedge.exe

pid	process
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

Processes:

msedge.exe

pid	process
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

Heist Editor.exeexplorer.exe

pid process

1748 Heist Editor.exe
1748 Heist Editor.exe
3824 explorer.exe
3824 explorer.exe

pid	process
1748	Heist Editor.exe
1748	Heist Editor.exe
3824	explorer.exe
3824	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Heist Editor.execmd.execmd.exemsedge.exe

description	pid	process	target process
PID 1748 wrote to memory of 2488	1748	Heist Editor.exe	cmd.exe
PID 1748 wrote to memory of 2488	1748	Heist Editor.exe	cmd.exe
PID 2488 wrote to memory of 3656	2488	cmd.exe	explorer.exe
PID 2488 wrote to memory of 3656	2488	cmd.exe	explorer.exe
PID 1748 wrote to memory of 4896	1748	Heist Editor.exe	cmd.exe
PID 1748 wrote to memory of 4896	1748	Heist Editor.exe	cmd.exe
PID 4896 wrote to memory of 4648	4896	cmd.exe	notepad.exe
PID 4896 wrote to memory of 4648	4896	cmd.exe	notepad.exe
PID 5048 wrote to memory of 4876	5048	msedge.exe	msedge.exe
PID 5048 wrote to memory of 4876	5048	msedge.exe	msedge.exe
PID 5048 wrote to memory of 4464	5048	msedge.exe	msedge.exe
PID 5048 wrote to memory of 4464	5048	msedge.exe	msedge.exe
PID 5048 wrote to memory of 4464	5048	msedge.exe	msedge.exe
PID 5048 wrote to memory of 4464	5048	msedge.exe	msedge.exe
PID 5048 wrote to memory of 4464	5048	msedge.exe	msedge.exe
PID 5048 wrote to memory of 4464	5048	msedge.exe	msedge.exe
PID 5048 wrote to memory of 4464	5048	msedge.exe	msedge.exe
PID 5048 wrote to memory of 4464	5048	msedge.exe	msedge.exe
PID 5048 wrote to memory of 4464	5048	msedge.exe	msedge.exe
PID 5048 wrote to memory of 4464	5048	msedge.exe	msedge.exe
PID 5048 wrote to memory of 4464	5048	msedge.exe	msedge.exe
PID 5048 wrote to memory of 4464	5048	msedge.exe	msedge.exe
PID 5048 wrote to memory of 4464	5048	msedge.exe	msedge.exe
PID 5048 wrote to memory of 4464	5048	msedge.exe	msedge.exe
PID 5048 wrote to memory of 4464	5048	msedge.exe	msedge.exe
PID 5048 wrote to memory of 4464	5048	msedge.exe	msedge.exe
PID 5048 wrote to memory of 4464	5048	msedge.exe	msedge.exe
PID 5048 wrote to memory of 4464	5048	msedge.exe	msedge.exe
PID 5048 wrote to memory of 4464	5048	msedge.exe	msedge.exe
PID 5048 wrote to memory of 4464	5048	msedge.exe	msedge.exe
PID 5048 wrote to memory of 4464	5048	msedge.exe	msedge.exe
PID 5048 wrote to memory of 4464	5048	msedge.exe	msedge.exe
PID 5048 wrote to memory of 4464	5048	msedge.exe	msedge.exe
PID 5048 wrote to memory of 4464	5048	msedge.exe	msedge.exe
PID 5048 wrote to memory of 4464	5048	msedge.exe	msedge.exe
PID 5048 wrote to memory of 4464	5048	msedge.exe	msedge.exe
PID 5048 wrote to memory of 4464	5048	msedge.exe	msedge.exe
PID 5048 wrote to memory of 4464	5048	msedge.exe	msedge.exe
PID 5048 wrote to memory of 4464	5048	msedge.exe	msedge.exe
PID 5048 wrote to memory of 4464	5048	msedge.exe	msedge.exe
PID 5048 wrote to memory of 4464	5048	msedge.exe	msedge.exe
PID 5048 wrote to memory of 4464	5048	msedge.exe	msedge.exe
PID 5048 wrote to memory of 4464	5048	msedge.exe	msedge.exe
PID 5048 wrote to memory of 4464	5048	msedge.exe	msedge.exe
PID 5048 wrote to memory of 4464	5048	msedge.exe	msedge.exe
PID 5048 wrote to memory of 4464	5048	msedge.exe	msedge.exe
PID 5048 wrote to memory of 4464	5048	msedge.exe	msedge.exe
PID 5048 wrote to memory of 4464	5048	msedge.exe	msedge.exe
PID 5048 wrote to memory of 4464	5048	msedge.exe	msedge.exe
PID 5048 wrote to memory of 4464	5048	msedge.exe	msedge.exe
PID 5048 wrote to memory of 3880	5048	msedge.exe	msedge.exe
PID 5048 wrote to memory of 3880	5048	msedge.exe	msedge.exe
PID 5048 wrote to memory of 1708	5048	msedge.exe	msedge.exe
PID 5048 wrote to memory of 1708	5048	msedge.exe	msedge.exe
PID 5048 wrote to memory of 1708	5048	msedge.exe	msedge.exe
PID 5048 wrote to memory of 1708	5048	msedge.exe	msedge.exe
PID 5048 wrote to memory of 1708	5048	msedge.exe	msedge.exe
PID 5048 wrote to memory of 1708	5048	msedge.exe	msedge.exe
PID 5048 wrote to memory of 1708	5048	msedge.exe	msedge.exe
PID 5048 wrote to memory of 1708	5048	msedge.exe	msedge.exe
PID 5048 wrote to memory of 1708	5048	msedge.exe	msedge.exe
PID 5048 wrote to memory of 1708	5048	msedge.exe	msedge.exe
PID 5048 wrote to memory of 1708	5048	msedge.exe	msedge.exe
PID 5048 wrote to memory of 1708	5048	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\Heist Editor.exe
"C:\Users\Admin\AppData\Local\Temp\Heist Editor.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1748

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c explorer/select,C:\Users\Admin\HELanguage.hel
2⤵
- Suspicious use of WriteProcessMemory
PID:2488

C:\Windows\explorer.exe
explorer /select,C:\Users\Admin\HELanguage.hel
3⤵
PID:3656

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start notepad C:\Users\Admin\HELanguage.hel
2⤵
- Suspicious use of WriteProcessMemory
PID:4896

C:\Windows\system32\notepad.exe
notepad C:\Users\Admin\HELanguage.hel
3⤵
- Opens file in notepad (likely ransom note)
PID:4648

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3824

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4972

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcac1f46f8,0x7ffcac1f4708,0x7ffcac1f4718
2⤵
PID:4876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1956,4552665060928475857,16632937713327481000,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
2⤵
PID:4464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1956,4552665060928475857,16632937713327481000,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1956,4552665060928475857,16632937713327481000,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
2⤵
PID:1708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,4552665060928475857,16632937713327481000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
2⤵
PID:5108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,4552665060928475857,16632937713327481000,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
2⤵
PID:2176

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,4552665060928475857,16632937713327481000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4212 /prefetch:1
2⤵
PID:1920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,4552665060928475857,16632937713327481000,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
2⤵
PID:4900

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1956,4552665060928475857,16632937713327481000,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4800 /prefetch:8
2⤵
PID:3976

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1956,4552665060928475857,16632937713327481000,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4800 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,4552665060928475857,16632937713327481000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
2⤵
PID:2896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,4552665060928475857,16632937713327481000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3704 /prefetch:1
2⤵
PID:1524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1956,4552665060928475857,16632937713327481000,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5540 /prefetch:8
2⤵
PID:3008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1956,4552665060928475857,16632937713327481000,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5532 /prefetch:8
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,4552665060928475857,16632937713327481000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
2⤵
PID:3948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,4552665060928475857,16632937713327481000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
2⤵
PID:2464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,4552665060928475857,16632937713327481000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
2⤵
PID:4296

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,4552665060928475857,16632937713327481000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
2⤵
PID:4500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,4552665060928475857,16632937713327481000,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
2⤵
PID:4488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,4552665060928475857,16632937713327481000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3628 /prefetch:1
2⤵
PID:832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,4552665060928475857,16632937713327481000,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
2⤵
PID:2884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1956,4552665060928475857,16632937713327481000,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5836 /prefetch:8
2⤵
PID:4584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,4552665060928475857,16632937713327481000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
2⤵
PID:2812

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1956,4552665060928475857,16632937713327481000,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6252 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4500

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3592

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c39b3aa574c0c938c80eb263bb450311

SHA1
f4d11275b63f4f906be7a55ec6ca050c62c18c88

SHA256
66f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c

SHA512
eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dabfafd78687947a9de64dd5b776d25f

SHA1
16084c74980dbad713f9d332091985808b436dea

SHA256
c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201

SHA512
dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
872d4b6ac9b60f491a73f8a5b27d94c9

SHA1
4a7b587b03662e81a0a1d8c679cde6a605a1bf79

SHA256
bcbe33d175243750baed044c7b8bc69e826e0fd9fbd7e74dca9217fc30cfadcb

SHA512
41393ffab5ac078cf3b11430597371c0d8b9b3c074502d336c50e04b8d310ea0c8ca40785b7a1f774ac769188cb50f124991400ba4f8c97eac67f25b9ef019ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9a06ceee7a425041eb08e6c2de31f2ee

SHA1
53d43961387d4d41a7a03bafbbf0c52747a22494

SHA256
ba1667e9747cb4025f488329860fdde9ef6c420348825333173f6db1af793229

SHA512
25beede097e619c3994043329c138515673ac462cbf0daf5c9a48e0c70ee6086bf1f90b7286a3505b78228fa0e907a02ff0596b40ad740c882d4d6ceb863c6c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bb856237d254cfc0a10e3696d8aa9eb3

SHA1
461cd941c8bfeeddf21bb7ca05dd81dc9622c310

SHA256
44ea5265730de81eef1ce2e0461a1634773c9e4180276c008e9f0ceffa557cad

SHA512
ec9bf6e965fb99ace124cc26e3e24319c7a9690eb3fc377fe2aa3f3469ef4c0aedf481d3e8b4d57d842921fef8c3c08b69375921410e05c1bd4e17ec638e6014

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e1fd783620cc1dd263c87ea5a640fd4e

SHA1
b2503dd7e077eec4ceec2a23b4218327908439a5

SHA256
1f1f42cca350c33ec0c69c6a078664f82d92080d2b9eef1a5dcb9260b16c1483

SHA512
36d88195ce2b3773ea86834abb7d70497c767852b1c457c28cc2e5b9154d27904b054bd18ca3d01fc48412719fc202239bd3d343069271064a7698fe897f6930

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a6a752a5fd96b22126e66f8bb8f0d329

SHA1
ad0e85e85d2aa88ac8425906edb39b2b07624f9b

SHA256
d372bc510fe8a308e4116148c694d365d76b15890a24f181a95bb3f734df8115

SHA512
86b377091e19fc377f441acb5571c64ac0d7bf52c40377ea21c6a44f542a53b90b95315b92509b44c3c8c9ad505a984813572b8c30e180d91aa759f85035be27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
de63a2125916fbbf934d3baedac0d847

SHA1
631bd3dc898ae053cd151de8ab5516b43cc33005

SHA256
46ad77081ed27efd0350e0722fcef2e8464fc90b9b279d71a81b85d5d4097c79

SHA512
c987f3deed3ab6d5cae463dba0a10daac3f108083b7983b86c2786eac0358c40991683052b6f3e5ebf193e515a69d7a6b9601c484893913101bc5a65bc9c5d3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
86e606d83eaed42aa261bc6ebe6ea38a

SHA1
e411819835f802e88d387097e49a0b0a75ff068a

SHA256
0b6a36811e4a0d5cb3f48c4bc9a25a8e725ce650c5e0bfdae7f0c83ca3979f60

SHA512
c27888326d34ec2eb44d835494fc3596d8aa0bb2c390120db645c7d0d4facd0face5f25f0f4ba64e5840c9192265efd16af5d29b6b39c106736bb66556ee3a44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5910de.TMP

Filesize
1KB

MD5
7dceee65a93a7b2922d0e64095919a97

SHA1
b683a780ddc771195a956e2df826f6160f012269

SHA256
e76c18dcfcbe3b57740aa8e2f52e528751829d24e5ca7eab7ba28a87caafa2f0

SHA512
a27b6e79f5566144b3125b7d61e4746e40c2c1f1574ea11d64b2a55c3e4c8891473ebaea1c364a3851f744843480fccd74442d6ed208f65d38fdbc06d6032ee4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
be5315f9b3cd3186b36787436237486c

SHA1
fcca3de896c8016647420a20cc0c45475036206b

SHA256
fbcc02b779b7a004f73b471e096009f63dec5b1262ba5d37e56d042c26901bfe

SHA512
8b7f8ca05f5e4349e634359aa286451a09e67d813517798cd5788f22815b717e7bed2626dccd17a69a4d0ae77e274954a8db5bc428040a557addc9b325f877db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7658e4e8ee25cf0fd1a9909a6ff3513c

SHA1
02639dbfc1e71799689a76cab8de0c21604d6396

SHA256
51456a7379cfc7fb26b7ad537acf24321521934eaf23b86ce8a44b3e5d816456

SHA512
2aa4d7f2039f9663cfc17c53f5048d1467441cf3b0ce8049a3edb4ff7252fd0aeccfa67ac68a55399faef4a0374ea648d01dcff62102ae9bd054a76f14076fac

Download Submit
C:\Users\Admin\Downloads\Project.zip

Filesize
8.4MB

MD5
331f4e7c4ee78c2e67272c697831ac32

SHA1
cc18bf4d394876e5ab8c40b50bd02139c3bde978

SHA256
962ae73a3ec602df82451477fd5f33f39d81179307e5dcf50cfaf47a68ec3956

SHA512
88e942d3a25d7b41507d5d7954e9f6ed0bef343d11d821672bd63137e435e0bbd101e03142040fb121d0ebcd0f2a84a21ffbfe24fa301dac51730a6f50a0fa1f

Download Submit
C:\Users\Admin\HELanguage.hel

Filesize
10KB

MD5
e48671f08c254445aab192942dbf6059

SHA1
e349a76d4d6562e81fb1b7cd9bec0a79a2adce4f

SHA256
7c642b8a501c94cd614f1178b2d11e3d39557ae5a26bd8e17e6c2a29f7790bcc

SHA512
d33216bd275286dfb8891b374e88e9f91bcb9f9dd50f6dbca298ae7cfabc92dfadab321f29845c2c612e2ef75e7b32c257f886ffad437eb3118bf112115b76f6

Download Submit
\??\pipe\LOCAL\crashpad_5048_NGDLBFHOXXXAZADH

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1748-9-0x00007FF73DA40000-0x00007FF73ED16000-memory.dmp

Filesize
18.8MB

Download
memory/1748-31-0x00007FF73DA40000-0x00007FF73ED16000-memory.dmp

Filesize
18.8MB

Download
memory/1748-29-0x00007FF73DA40000-0x00007FF73ED16000-memory.dmp

Filesize
18.8MB

Download
memory/1748-27-0x00007FF73DA40000-0x00007FF73ED16000-memory.dmp

Filesize
18.8MB

Download
memory/1748-22-0x00007FF73DA40000-0x00007FF73ED16000-memory.dmp

Filesize
18.8MB

Download
memory/1748-20-0x00007FF73DA40000-0x00007FF73ED16000-memory.dmp

Filesize
18.8MB

Download
memory/1748-18-0x00007FF73DA40000-0x00007FF73ED16000-memory.dmp

Filesize
18.8MB

Download
memory/1748-10-0x00007FF73DA40000-0x00007FF73ED16000-memory.dmp

Filesize
18.8MB

Download
memory/1748-8-0x00007FF73DA40000-0x00007FF73ED16000-memory.dmp

Filesize
18.8MB

Download
memory/1748-0-0x00007FF73DA40000-0x00007FF73ED16000-memory.dmp

Filesize
18.8MB

Download
memory/1748-7-0x00007FF73DA40000-0x00007FF73ED16000-memory.dmp

Filesize
18.8MB

Download
memory/1748-6-0x00007FF73DA40000-0x00007FF73ED16000-memory.dmp

Filesize
18.8MB

Download
memory/1748-2-0x00007FF73DA40000-0x00007FF73ED16000-memory.dmp

Filesize
18.8MB

Download
memory/1748-5-0x00007FF73DA40000-0x00007FF73ED16000-memory.dmp

Filesize
18.8MB

Download
memory/1748-4-0x00007FF73DA40000-0x00007FF73ED16000-memory.dmp

Filesize
18.8MB

Download
memory/1748-3-0x00007FF73DA40000-0x00007FF73ED16000-memory.dmp

Filesize
18.8MB

Download
memory/1748-1-0x00007FFCC9930000-0x00007FFCC9932000-memory.dmp

Filesize
8KB

Download