e02832385c39f13876f7416350a9d76a93b4e97648c77e073e226217802832a6

Resubmissions

22/08/2024, 22:09

240822-124ajszhkc 7

Analysis

max time kernel
30s
max time network
31s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
22/08/2024, 22:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JJSploit.exe
Size

9.8MB
MD5

5aa8497659e32136c48465a91e092d1a
SHA1

f03bd00ad306305630d647805648822b542beb60
SHA256

e02832385c39f13876f7416350a9d76a93b4e97648c77e073e226217802832a6
SHA512

abf442476c2d2646e62695bd4c3b9b56c445e0bf58b0add81a9f933227835a7ee959646ddb426a152b507b503c3df670b20e8ebb2c3a6f8fd69d023b6c128751
SSDEEP

196608:X0CW7PVmsuHfDpHHZ0ry9bUhLnCHpw4aGIE9XBp:X0CW794HfDpHHz1iWw4a/oXBp

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Control Panel\International\Geo\Nation	cmd.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JJSploit.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = cac8c10fe0f4da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\CIStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 0a8ac51be0f4da01	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B72164 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 167c940fe0f4da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DomStorageState	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\www.msn.com	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 8fc2b218e0f4da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.msn.com	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 8b09021be0f4da01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\msn.com	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe

Suspicious behavior: MapViewOfSection 14 IoCs

pid	Process
4652	MicrosoftEdgeCP.exe
4652	MicrosoftEdgeCP.exe
4652	MicrosoftEdgeCP.exe
4652	MicrosoftEdgeCP.exe
4652	MicrosoftEdgeCP.exe
4652	MicrosoftEdgeCP.exe
4652	MicrosoftEdgeCP.exe
4652	MicrosoftEdgeCP.exe
4652	MicrosoftEdgeCP.exe
4652	MicrosoftEdgeCP.exe
4652	MicrosoftEdgeCP.exe
4652	MicrosoftEdgeCP.exe
4652	MicrosoftEdgeCP.exe
4652	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4376	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4376	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4376	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4376	MicrosoftEdgeCP.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
788	JJSploit.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4480	MicrosoftEdge.exe
4652	MicrosoftEdgeCP.exe
4376	MicrosoftEdgeCP.exe
4652	MicrosoftEdgeCP.exe
4712	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 788 wrote to memory of 792	788	JJSploit.exe	72
PID 788 wrote to memory of 792	788	JJSploit.exe	72
PID 788 wrote to memory of 792	788	JJSploit.exe	72
PID 788 wrote to memory of 2812	788	JJSploit.exe	73
PID 788 wrote to memory of 2812	788	JJSploit.exe	73
PID 788 wrote to memory of 2812	788	JJSploit.exe	73
PID 4652 wrote to memory of 1212	4652	MicrosoftEdgeCP.exe	78
PID 4652 wrote to memory of 1212	4652	MicrosoftEdgeCP.exe	78
PID 4652 wrote to memory of 1212	4652	MicrosoftEdgeCP.exe	78
PID 4652 wrote to memory of 5060	4652	MicrosoftEdgeCP.exe	83
PID 4652 wrote to memory of 5060	4652	MicrosoftEdgeCP.exe	83
PID 4652 wrote to memory of 5060	4652	MicrosoftEdgeCP.exe	83
PID 4652 wrote to memory of 4740	4652	MicrosoftEdgeCP.exe	87
PID 4652 wrote to memory of 4740	4652	MicrosoftEdgeCP.exe	87
PID 4652 wrote to memory of 3988	4652	MicrosoftEdgeCP.exe	89
PID 4652 wrote to memory of 3988	4652	MicrosoftEdgeCP.exe	89
PID 4652 wrote to memory of 3988	4652	MicrosoftEdgeCP.exe	89
PID 4652 wrote to memory of 3988	4652	MicrosoftEdgeCP.exe	89
PID 4652 wrote to memory of 3988	4652	MicrosoftEdgeCP.exe	89
PID 4652 wrote to memory of 3988	4652	MicrosoftEdgeCP.exe	89
PID 4652 wrote to memory of 4740	4652	MicrosoftEdgeCP.exe	87
PID 4652 wrote to memory of 4740	4652	MicrosoftEdgeCP.exe	87
PID 4652 wrote to memory of 4740	4652	MicrosoftEdgeCP.exe	87
PID 4652 wrote to memory of 4740	4652	MicrosoftEdgeCP.exe	87

C:\Users\Admin\AppData\Local\Temp\JJSploit.exe
"C:\Users\Admin\AppData\Local\Temp\JJSploit.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:788
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /C start https://www.youtube.com/@Omnidev_
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  PID:792
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /C start https://www.youtube.com/@WeAreDevsExploits
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  PID:2812

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4480

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4268

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4652

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4376

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:1212

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:3280

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:5060

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4740

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4712

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:3988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\2N8U0PEY\favicon[1].ico

Filesize
758B

MD5
84cc977d0eb148166481b01d8418e375

SHA1
00e2461bcd67d7ba511db230415000aefbd30d2d

SHA256
bbf8da37d92138cc08ffeec8e3379c334988d5ae99f4415579999bfbbb57a66c

SHA512
f47a507077f9173fb07ec200c2677ba5f783d645be100f12efe71f701a74272a98e853c4fab63740d685853935d545730992d0004c9d2fe8e1965445cab509c3

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DFF948ABCDA1E216B6.TMP

Filesize
16KB

MD5
68d65b730985b22bf6100c258b125115

SHA1
bc30394b0ecbedb4a42750c7417f558f274e4608

SHA256
aec3a2e65aa8ed13e77d9b79f7131224305dde66c4648fe2749477bb24b378d2

SHA512
d58551c5b51e54a903d5eb9078ba171088893f6c590a779f67460957e9398559abe7b3328cb496cefadf35624adec0927822956fbc3db326c194ff00fbb357da

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\BFAAUMFB\rs=AGKMywHf1gcLkPfBqBPH7qb2MME16kbGMQ[1].css

Filesize
2.9MB

MD5
238b097928800a671fb121a1218b2a10

SHA1
737a7e84ba2c887f75c0280184cd8a32ab6822a3

SHA256
052f82bcb7efd1a6dd99545d4bec7d2b19d4b6f2c12ada7e7b9f13b158681d4f

SHA512
6b483b0d4c2504b254c323cc1f9c9cae6d1eff2dc54371345e7a6f6c898c938ad55122ef1302d8f853f6a985f581056fa62affcb1bf89176ed7b8a55b724a89a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\BFAAUMFB\scheduler[1].js

Filesize
9KB

MD5
d253fb13ad8f6827d24cf504b725eafa

SHA1
81ee8c43d98fbced10e03ae0023fc12c25e982d9

SHA256
9510a0e5e9fc3d18f09b21b22515d4a13494293f1a9f9f3caea141e2083b8c9f

SHA512
2ea9a0b6b0e6505415e41efb7e124b59a61623466f4b810661f01af9f9ddc196c6c09ed6f8c592a320be134f0d92c2e733fa4594b200d867c5a8d63374ed56c3

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\BFAAUMFB\www-onepick[1].css

Filesize
739B

MD5
9ace9ca4e10a48822a48955cbd3f94d0

SHA1
1f0efa2ee544e5b7a98de5201fb8254b6f3eb613

SHA256
f8fdbb9c5cdceb1363bb04c5e89b3288ea30d79ef1a332e7a06c7195dd2e0ec4

SHA512
25354aeecb224fd6d863c0253cd7ad382dce7067f4147790ee0ce343f8c3e0efb84e54dd174116e7ad52d4a7e05735039fa1085b739abbe80f9e318e432eed73

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\KXE2MQF8\intersection-observer.min[1].js

Filesize
5KB

MD5
e02d881229f4e5bcee641ed3a2f5b980

SHA1
29093656180004764fc2283a6565178eb91b5ef3

SHA256
8037c1f1e0e4d3d7955f591a14a4b4d090141f1d210ef8b793ce5b345f08f7f5

SHA512
f4e8e21b91ee33879a2295215cba91e12851891165fe3f9f98913022280ef8192fd3f5def06aa8ac1fbe6d43d09034b0bb8e29e8703366a012e1fde6ff2828db

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\KXE2MQF8\network[1].js

Filesize
13KB

MD5
a6b9d65542f265d2edf1ef3dc3473500

SHA1
8a81a628de798cd9658b2705a830c664cf19d485

SHA256
2dc0785db6ff5df6216126dc7a5ce4a60097f99bb5213a19e7582b154cbde9bd

SHA512
59689a131f0e8d8c13e22edb3e9436cff75f6a8aaba32220728012e4528d18c0144130650d40a1dbf2a9e7f32a1af14663dc20dab87607a389bd65e384d96c9c

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\KXE2MQF8\spf[1].js

Filesize
38KB

MD5
8073e10a24455e1882b81bc94de8acaf

SHA1
8aba221eeabe20ac6b2a5e17d388752472b1b540

SHA256
5cc32b48e9cc95135cf1f94b68473cea73eec505d21dd1d213208bc035daa563

SHA512
16bacc989a536e3774372170e9a7972252aaf3fbb18fc7647feb0e206efdcc7d6ee034aa3605cfe8adc0e1e56e3bb31a13189443b7dbc07edbfead5e8cc4af81

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\KXE2MQF8\www-tampering[1].js

Filesize
10KB

MD5
67a2b53543ad2c2b6aee2cca421fdbcc

SHA1
ad57245177a4a3ac28fa94a0ca72c72a2eb6b6bd

SHA256
a7cd9877ada62f879ca667eed019688cf32198f893cac6a9b1b938ed701ca58a

SHA512
2cd3c32181e42386bd3a112eaf5cc009da4e3b6614e670cfdb07243af27c91b28fe6ee32c052f99afb3d15b2b7b4a0189d45c0ee9d3e86249028514f634af2ca

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\QCYPLWW5\desktop_polymer[1].js

Filesize
8.1MB

MD5
26d32e163721308ae983e96ae2a495ec

SHA1
1870edad7430e3d5c60fd6a9df4b1bf923e1b1e5

SHA256
40ac1e414c2fe9cbb6474b41c4c253dba6cd726a2dcc3bc790b78dda97174c85

SHA512
0baf0644e1b78017143b77357713ceaf997189d51358e18e939a63f2a887d04d5f04b1b6faa96ab98626f90189df9dac9a3bda45057b99481b2459840d23d91c

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\QCYPLWW5\www-i18n-constants[1].js

Filesize
5KB

MD5
877a2b1590385d79323ef992abe9e961

SHA1
f2f65882785537d6f3eeba7f02ea233f9e55672f

SHA256
ff474db3ea4409f034cbae6ae738bc80fb18734ccd38f87fcde90d02e11cfac3

SHA512
c7b9bda266c59a19476d7eaa3f6bc10d8d916345ff4195ee5932f5d5d884a487407552a29d576a9dd53dfd2588069c7376f660800f5ab7f8e1bea78cdd146e14

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\QCYPLWW5\www-main-desktop-watch-page-skeleton[1].css

Filesize
8KB

MD5
64c8e3b11cfffc8ebf2240e4f46ab492

SHA1
71276680811731f983502e477a87e87cfe72d75f

SHA256
3acc199c41eb3c884ee9884c15e6b78975499be2255aa203dba38ef24440181c

SHA512
497a48233bb198e05517e2cba003c2c5ba25183e1654b5b8252b9823f0859497ccab66a77e243238b27ea6eb826ae4fc72efb2f32b2b378edee7f9dfb87f4756

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\YWKYWNFN\css2[1].css

Filesize
2KB

MD5
d3ba4265c51f67eee68700ad71c86e2d

SHA1
deb7262156fd88684458104797b883227a105d6b

SHA256
8b219ede56fd2c35318b6e9da10833ed74e4a30a32dd6e368c00e5feef9c0e8f

SHA512
926067c174bdef92a97574d13200bd6cae081562a1c9830965d197b3b43e751250fced4dab78c240f4acfe4a2d29fdda56337bac5e0ec7f3c9ddeab1cc0cbab3

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\YWKYWNFN\web-animations-next-lite.min[1].js

Filesize
49KB

MD5
9e1f5b2285bce3a471297b1505058b57

SHA1
c0cbe8b0a96f32c25adbae33932188d495a4135c

SHA256
708021b0a03278843afdf5190777b25bead3458548e7c221ac1ff6f6e6e17bad

SHA512
a10b9f0fa257580a1e44b5f756f99a149193d6b71f98590eba7bff2a6a3853c32a0d8d44a8967154eefab884d7964d148d38991393cc4785249f38253242099b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\YWKYWNFN\webcomponents-ce-sd[1].js

Filesize
95KB

MD5
2b26e985df91c84424c744d8557bba69

SHA1
901e4665ee79cd7420139e39fcee2db0eea683ee

SHA256
4011a87b53c8fedc7e54076929d677a2d8f8cd76ab20ce4eb2e027778083cfcd

SHA512
c9a27e9970123f2ae0d692834b6f1117f2f20d5835a1670a3bace470123471cd7754425976abccce4abac7612659bf31f755e3e8ad9ff807d0d3e74db4154a78

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\E63PWBI6.cookie

Filesize
266B

MD5
69b612c84c05f932921cbaf10e88727d

SHA1
9361abc21e087ad6fbc5dc868b9dcb7bf6f17b28

SHA256
664ad272625662da393cd7223cd559cbdfccf0c3742d4b9259049ca72fb0ba15

SHA512
63cbcea2571fb11530de0346aa8625a94d698b5da4e4e53380be6556158eca747f823b4d99e9f29847041918b21aa31ab7744dd32d28b933195fdf61e13a4d7f

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
854B

MD5
e935bc5762068caf3e24a2683b1b8a88

SHA1
82b70eb774c0756837fe8d7acbfeec05ecbf5463

SHA256
a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d

SHA512
bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
afd5c8bc257ade6a96130cc5dc16b970

SHA1
c8d42d613daa364cbda9532b65fdf6cbc4e9975d

SHA256
dec29a3a3674ad930d2b57ddf58bc07529d9c8fd13aa3deb5274e9c46d14e85f

SHA512
60a59c5686d041539146921677ac5d355eb907e4d4c0b10c69dcb6bebb3119af593ab7dfb2e016e7a65d3c0b0b59130c16fcf3f7a609c41fc5d7b7984deaf5bd

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\DDE8B1B7E253A9758EC380BD648952AF_4FE99CA8B2B48146026AB576A9AEFDDA

Filesize
471B

MD5
49a6825231a8d44dbd8904cfefb0114f

SHA1
3cb57a3771d1c3f9ad32d4c0e5574c78bd5dc183

SHA256
fe471359588de174fbdab711c3ceb2b4fb420d384995bf540e5b0a8cbcb6e0c1

SHA512
3c4c8a59f24be8de2d98377de6df7e6afbc89e6161f1ac1ee54f3812064942f52d20a5c9e79e6042c310820436f2d45d446030b8f8f58e11a35a9e3e719d64f9

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\DDE8B1B7E253A9758EC380BD648952AF_68D058512F3515153DEB95A1F4E72552

Filesize
471B

MD5
422606778f6d2e49a58db1bbf3c1151a

SHA1
b14a21b8e924a3683118ecbf7e24ea7fabdc8d3b

SHA256
b8db68a61414973a8df9bf4eada88200d0d8780f6b8990d1b1a481f53872266d

SHA512
76f73bdc1a19ea67b6d8bbab025546f71d704b27622d3cbf4c8e62098fb25ca0d699d53ee551abbd4cbca7ea9ca0281c6dacd06d4af217b80539df5997a79de4

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
170B

MD5
2aa5dfcfe75f0f58a10db0ca80886c6c

SHA1
247853eff1e844c868a11d342b65473fc159c618

SHA256
841b6f0030492862d8d7d67e1470b7dd675637163a3436a037c5ff412ff8cfc4

SHA512
01d74db7d4b424d691f3d1e11a1bce359ee29a71423fabb84f41d831102cd9c3d263220ff039541a4c6e5bcbec7e5729a48b09c33b3909cdd90bae435ef3e952

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
9c6380c1e2440bd5e590d20c598cf4f1

SHA1
e4ece4fde9eb506485e2f86e4fffa69bbaf8a225

SHA256
9c93baa2ff2f72d86e0232858ddddece90bf3923f6075c4930b2507180192b4c

SHA512
83a2509c835a64cc93c7886c088221b0662be4edc8cdd91c617b4a82c6f4526abe9ab86a4f89c09c5983d3780413e97cdcbb0567b591529db55f3a8951c34067

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\DDE8B1B7E253A9758EC380BD648952AF_4FE99CA8B2B48146026AB576A9AEFDDA

Filesize
402B

MD5
2e5bbd76de7266ff14b092548d6eff18

SHA1
885769555540338bff6ec556aa3fcfd22ca0069c

SHA256
92f68b8f65a15e10151b734b5c4db0b2082a56113182049300cab9d2ec4a5be6

SHA512
9745413a75576b562ec14931f00e400196ee33cb86615ebfd30b2a8736813faef6ce9821023036ffa72681857973727dcaa9fb73c13aad18eda4bc90c502b324

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\DDE8B1B7E253A9758EC380BD648952AF_68D058512F3515153DEB95A1F4E72552

Filesize
406B

MD5
c4cedb1537eb19ba5716dba3a57a8c1b

SHA1
a0744591614e4e3491601fd12106cdd5fa068e52

SHA256
0c657b1b6d493c9365553ca54479259af6e41f3f66cf1c6298ac18bfe4223c3f

SHA512
86adc16df47a5b7061f446fe5a7fd472df0e6617abc7e32a90c0617615b3b58592beb33df70f0543bfaebb2727e75a13c8ef1be3245e46a08d6e7b45a7b0e7a6

Download Submit
memory/1212-104-0x0000020240700000-0x0000020240720000-memory.dmp

Filesize
128KB

Download
memory/1212-113-0x0000020240B40000-0x0000020240B60000-memory.dmp

Filesize
128KB

Download
memory/1212-72-0x00000202400E0000-0x00000202400E2000-memory.dmp

Filesize
8KB

Download
memory/1212-74-0x0000020240300000-0x0000020240302000-memory.dmp

Filesize
8KB

Download
memory/1212-76-0x00000202403C0000-0x00000202403C2000-memory.dmp

Filesize
8KB

Download
memory/1212-67-0x000002022FD00000-0x000002022FE00000-memory.dmp

Filesize
1024KB

Download
memory/3988-282-0x00000289D3980000-0x00000289D3A80000-memory.dmp

Filesize
1024KB

Download
memory/4376-47-0x0000012701300000-0x0000012701400000-memory.dmp

Filesize
1024KB

Download
memory/4376-48-0x0000012701300000-0x0000012701400000-memory.dmp

Filesize
1024KB

Download
memory/4480-19-0x0000023F15F20000-0x0000023F15F30000-memory.dmp

Filesize
64KB

Download
memory/4480-3-0x0000023F15E20000-0x0000023F15E30000-memory.dmp

Filesize
64KB

Download
memory/4480-38-0x0000023F132B0000-0x0000023F132B2000-memory.dmp

Filesize
8KB

Download
memory/4712-214-0x0000020E8F200000-0x0000020E8F300000-memory.dmp

Filesize
1024KB

Download
memory/4712-230-0x0000020EA0020000-0x0000020EA0040000-memory.dmp

Filesize
128KB

Download
memory/4712-233-0x0000020EA0080000-0x0000020EA0180000-memory.dmp

Filesize
1024KB

Download
memory/4712-241-0x0000020EA0B60000-0x0000020EA0B80000-memory.dmp

Filesize
128KB

Download
memory/4712-273-0x0000020EB1DE0000-0x0000020EB1EE0000-memory.dmp

Filesize
1024KB

Download
memory/4740-205-0x000001CE08630000-0x000001CE08730000-memory.dmp

Filesize
1024KB

Download
memory/4740-210-0x000001CE19340000-0x000001CE19342000-memory.dmp

Filesize
8KB

Download
memory/4740-208-0x000001CE19320000-0x000001CE19322000-memory.dmp

Filesize
8KB

Download
memory/4740-204-0x000001CE08630000-0x000001CE08730000-memory.dmp

Filesize
1024KB

Download
memory/5060-189-0x0000029D10FD0000-0x0000029D10FF0000-memory.dmp

Filesize
128KB

Download
memory/5060-188-0x0000029D10FD0000-0x0000029D10FF0000-memory.dmp

Filesize
128KB

Download
memory/5060-157-0x0000029D11200000-0x0000029D11300000-memory.dmp

Filesize
1024KB

Download