Analysis
-
max time kernel
59s -
max time network
41s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
05-09-2024 12:28
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://reformedtundra.itch.io/windows-12-exe
Resource
win10-20240404-en
windows10-1703-x64
15 signatures
60 seconds
General
-
Target
https://reformedtundra.itch.io/windows-12-exe
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\rescache\_merged\1601268389\715946058.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\715946058.pri taskmgr.exe File created C:\Windows\rescache\_merged\2717123927\1590785016.pri taskmgr.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri taskmgr.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdge.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\4183903823\2290032291.pri taskmgr.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri taskmgr.exe File created C:\Windows\rescache\_merged\4183903823\2290032291.pri taskmgr.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage\ProcessingFlag = b0e7c9328fffda01 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\Total = "547" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\Total = "132" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\CIStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\ACGStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CacheLimit = "256000" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\itch.io\Total = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com\ = "0" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com\ = "3514" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "268435456" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 3d66eb328fffda01 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 70ce681c8fffda01 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\Total = "656" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Extensible Cache MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\itch.io MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState\EdpCleanupState = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 4105ca328fffda01 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com\ = "547" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListFirstRun = "3" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\NumberOfSubdomains = "1" MicrosoftEdgeCP.exe -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Downloads\Windows 12 exe.zip.kt6nhy8.partial:Zone.Identifier browser_broker.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
pid Process 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 2692 MicrosoftEdgeCP.exe 2692 MicrosoftEdgeCP.exe 2692 MicrosoftEdgeCP.exe 2692 MicrosoftEdgeCP.exe 2692 MicrosoftEdgeCP.exe 2692 MicrosoftEdgeCP.exe -
Suspicious use of AdjustPrivilegeToken 14 IoCs
description pid Process Token: SeDebugPrivilege 1196 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 1196 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 1196 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 1196 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4372 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4372 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 2648 taskmgr.exe Token: SeSystemProfilePrivilege 2648 taskmgr.exe Token: SeCreateGlobalPrivilege 2648 taskmgr.exe Token: SeDebugPrivilege 4384 taskmgr.exe Token: SeSystemProfilePrivilege 4384 taskmgr.exe Token: SeCreateGlobalPrivilege 4384 taskmgr.exe Token: 33 2648 taskmgr.exe Token: SeIncBasePriorityPrivilege 2648 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 4384 taskmgr.exe 2648 taskmgr.exe 4384 taskmgr.exe 2648 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 4384 taskmgr.exe 2648 taskmgr.exe 4384 taskmgr.exe 2648 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe 4384 taskmgr.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 4020 MicrosoftEdge.exe 2692 MicrosoftEdgeCP.exe 1196 MicrosoftEdgeCP.exe 2692 MicrosoftEdgeCP.exe 1012 MicrosoftEdgeCP.exe -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 2692 wrote to memory of 428 2692 MicrosoftEdgeCP.exe 77 PID 2692 wrote to memory of 428 2692 MicrosoftEdgeCP.exe 77 PID 2692 wrote to memory of 428 2692 MicrosoftEdgeCP.exe 77 PID 2692 wrote to memory of 428 2692 MicrosoftEdgeCP.exe 77 PID 2692 wrote to memory of 428 2692 MicrosoftEdgeCP.exe 77 PID 2692 wrote to memory of 428 2692 MicrosoftEdgeCP.exe 77 PID 2692 wrote to memory of 428 2692 MicrosoftEdgeCP.exe 77 PID 2692 wrote to memory of 428 2692 MicrosoftEdgeCP.exe 77 PID 2692 wrote to memory of 428 2692 MicrosoftEdgeCP.exe 77 PID 2692 wrote to memory of 428 2692 MicrosoftEdgeCP.exe 77 PID 2692 wrote to memory of 428 2692 MicrosoftEdgeCP.exe 77 PID 2692 wrote to memory of 428 2692 MicrosoftEdgeCP.exe 77 PID 2692 wrote to memory of 428 2692 MicrosoftEdgeCP.exe 77 PID 2692 wrote to memory of 428 2692 MicrosoftEdgeCP.exe 77 PID 2692 wrote to memory of 428 2692 MicrosoftEdgeCP.exe 77 PID 2692 wrote to memory of 428 2692 MicrosoftEdgeCP.exe 77 PID 2692 wrote to memory of 428 2692 MicrosoftEdgeCP.exe 77 PID 2692 wrote to memory of 428 2692 MicrosoftEdgeCP.exe 77 PID 2692 wrote to memory of 428 2692 MicrosoftEdgeCP.exe 77 PID 2692 wrote to memory of 428 2692 MicrosoftEdgeCP.exe 77 PID 2692 wrote to memory of 428 2692 MicrosoftEdgeCP.exe 77 PID 2692 wrote to memory of 428 2692 MicrosoftEdgeCP.exe 77 PID 2692 wrote to memory of 428 2692 MicrosoftEdgeCP.exe 77 PID 2648 wrote to memory of 4384 2648 taskmgr.exe 85 PID 2648 wrote to memory of 4384 2648 taskmgr.exe 85 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\LaunchWinApp.exe"C:\Windows\system32\LaunchWinApp.exe" "https://reformedtundra.itch.io/windows-12-exe"1⤵PID:4888
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4020
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
- NTFS ADS
PID:204
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2692
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1196
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
PID:428
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1012
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4372
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /12⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4384
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:4812
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:3236
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14KB
MD5a0575da55c726f427e0f3744c0b6a0ea
SHA1f39112fcdaaca7be1fe4dff441ce28c904723ea1
SHA256b01694e604eb220a923da5cacf58ab4fd0fcb1088c35b12a9708804de171ffd2
SHA5127ecdf79e85026cc3f75bf73377e55118309ebf17a0063575116f6da7141276750987e267d6f81e98826e26db61190730b5b2920a8e71c076064b145586907abf
-
Filesize
74KB
MD5d4fc49dc14f63895d997fa4940f24378
SHA13efb1437a7c5e46034147cbbc8db017c69d02c31
SHA256853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1
SHA512cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a
-
Filesize
171KB
MD530ec43ce86e297c1ee42df6209f5b18f
SHA1fe0a5ea6566502081cb23b2f0e91a3ab166aeed6
SHA2568ccddf0c77743a42067782bc7782321330406a752f58fb15fb1cd446e1ef0ee4
SHA51219e5a7197a92eeef0482142cfe0fb46f16ddfb5bf6d64e372e7258fa6d01cf9a1fac9f7258fd2fd73c0f8a064b8d79b51a1ec6d29bbb9b04cdbd926352388bae
-
Filesize
2KB
MD5b8da5aac926bbaec818b15f56bb5d7f6
SHA12b5bf97cd59e82c7ea96c31cf9998fbbf4884dc5
SHA2565be5216ae1d0aed64986299528f4d4fe629067d5f4097b8e4b9d1c6bcf4f3086
SHA512c39a28d58fb03f4f491bf9122a86a5cbe7677ec2856cf588f6263fa1f84f9ffc1e21b9bcaa60d290356f9018fb84375db532c8b678cf95cc0a2cc6ed8da89436
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\CILB2OEP\js[1].js
Filesize275KB
MD55da73cd27fb5b7f608d9ee21f88cea72
SHA1cb066afbe562a8e024c2f60c2ca77efb3b1107ce
SHA256f682b6b630d27f15c9c16d5539d1c56bd03646b635162f4ee42f90a09884c124
SHA51283f494cae9714c57eaeafcc477ebb2cdb118f6ed9ea9247443ca6d73e3ac9978383e195385587334d5d1a96084ffb302dfd191a53e47525ba206ad4c1ff4ed14
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\CILB2OEP\lato-v14-latin-italic[1].woff2
Filesize23KB
MD5b45e52f342dc29c8553f51a99f924871
SHA184ffaa7306ce72dc9dce975454298b91dc4d00be
SHA25688f15027c3aadf50ab39cea089b1f8aa3a18da7c47b30569c1f7489470c05292
SHA512d4eaa02b2b16f047658b14250f1531e1b90f3575bc7a084f06ba772c24e1436be4f223dfe784b0a5956d039ba385f2b7c1697d51c8d3a568d1bc6ebc9c99a726
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\CILB2OEP\lato-v14-latin-regular[1].woff2
Filesize22KB
MD5f1a4a058fbba1e35a406188ae7eddaf8
SHA1e5e25503a9a6976e3ac4b1893a767c8a7a72eba0
SHA2561670565574aab8aa0a287a4cd8f49cf0d8b0959ebe344f90ca8af696ede9c23b
SHA512c0f3138f59034f26f89a7bee8a3a0af749c4dd119997ca121121ff19a35e690098ddd6e4d022d86a81783837fea39aa66d47cac1b19127cda5a0b1355714fa75
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\JKE7A3GY\lato-v14-latin-900[1].woff2
Filesize21KB
MD5f2de2c6ec69b0c11f1bc44c5348c2f35
SHA135380c04729ff2041e192756bea3052e7de2c5d0
SHA256abde463ef27458713d91e9be883fdd389298ef57411b601cab5f66db609c508d
SHA512847a73f219b215d03fac4335720d7be8ed6ec479e4a83d1c2d5e980f3572a54b8d2fff5ff117be6575c3d982c6e20ee01564dfae0290e70576ee0acc2b998259
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\LYOG6IM2\bundle.min[1].js
Filesize111KB
MD55367c161f00ba356d8b143ede4d78591
SHA19dbfc6218a65e8dbe0be21eb46081d9d8fe02c65
SHA2569da2294cc3da6275d5b88076abb0cb068f9a7b5a18f62a564ecd3a1caba920c1
SHA512eb1e3d4b05105768ea24b13a4fea5ae5baec71b476175ea27f8b139d9858186c0f011989e10f55aeb7cdbdcbe25b85d532f61d49df79a3259fd9dcd4be860eea
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\LYOG6IM2\lato-v14-latin-700[1].woff2
Filesize22KB
MD57fbbfd1610770d594aef639cfefdd0b0
SHA1e8e478141c6bea23ed8f1b52b7062eebbafb29f0
SHA256ead13ccfbdea5462c3af37aa6ae04e64ed65a31c33f76e46da5e86ec85c52064
SHA5120b4a872e56961cdd20208fd631dc45175fb7b0475c2047a9df9297be87dd050cd980fbb170b09a144839c20900456b8837374954cd53efefece7b9fe05b2ddbd
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\LYOG6IM2\main[1].css
Filesize543KB
MD535734e32bdc368e334783651eb578de5
SHA11440e6752807f2a1579d66485a90479d704907e6
SHA256b6289cded72f192a300ff93332b5671d754c4bf98aa326e9f180b3f2d2347b88
SHA51227c9514a4c2f5f9f60eb80f79d2aae8137ae7a9d9e65803bc36daed3e4c747d1e53bc4b3f29dbc798044f8572acdb8193724018d6643e4a2bd3f2c17bd458b75
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\VPH5IKN1\jquery.maskMoney[1].js
Filesize22KB
MD550ae60d621c698f2993752e5525a7791
SHA1579534d05690d381130410e3caafccc1a4569da1
SHA256526a6d6740bf408dce3e6671745b3cfd5a953c8632faf523dabd38d068087360
SHA512f348d52cc85c769dbe943ef7de58513c5082b1d84060ab94b706b78b9f379a56d00f69207414e20ca0f21e405ac5386ad379ea0702894ae0cbe726f9f8191165
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\VPH5IKN1\lib.min[1].js
Filesize124KB
MD5207451926a991de4adc16e6c64aab430
SHA160cb4c06d1714eab643a99a56fbb890a1aba421f
SHA2560451ab174857156c1abb1a91baa9c569591defd2ca5a20fc4f8f78f4f6b1320e
SHA51250f2f4a8d717cd4c13dc88611112d91079cf6b3d59e449bae7bcad0dca019070e1bf6b6849c2de072b9b6db496e0a7c7a43fce2d668d8e36c0bfbb57f0c5d15d
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\8AWOIRYS\favicon[1].ico
Filesize5KB
MD59a3fe3a8b81bbf459c98753295394945
SHA10549a475c5fce345669877802f80eeffadfa6fff
SHA256f5392ebf26bc5e9599340a9e5cef6644629b2b43bdbeb5c03e8382aaab7ef165
SHA5121e4978397370430859b3c3c8f18015ec040fa8f1e15ea5086ffba069bacd537255c7ec9409117a2a27fd401c6b90a27f586183360680915dbed75cdf57a430ec
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\HZ6Q90KN\sNGgws[1].png
Filesize2KB
MD59f1421643d651ffbe419cc07534ae63f
SHA151ee1eaa853ee699c0499df5b227b294f46dfd62
SHA2567a71b0515807f3b7f2a7067bbf2e369e61e708257c931f5a17aceaf551be8b8d
SHA512b636516921f72eb5c709f5e20f9f5006927c3cf1b4bd125b8fdad4f7bea43ee7b5c5d4fccc956d403662af10c22b70e9192ac1f9da107a47158f9c5b6f797538
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Filesize4KB
MD51bfe591a4fe3d91b03cdf26eaacd8f89
SHA1719c37c320f518ac168c86723724891950911cea
SHA2569cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8
SHA51202f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\VPH5IKN1\Windows 12 exe[1].zip
Filesize92KB
MD53e5c9c0c799fa1b684050222686d0142
SHA128500d34a07cb1d71dd1bb7949ea21e696b8a001
SHA256402c80e8550c9d7c9494e07ff9d8ea3e0217a6435425612510e0dcad66b99cd8
SHA512c425c6ad75412b41c3e30cc002232181018ee6bd7dee96cecdcce3ade2fe5175640f3c94dd7a119983e8c920329f5f9f21173264d518c623bb829adfffbb8c75
