Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
62s -
max time network
65s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
30/10/2022, 00:37
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://docs.google.com/drawings/d/1YIYAoLNbk8ssJNGma4kD3WEjTxX8M8BqzXUQqn_4XcA/preview?234062643247775417571081108326430885331341663
Resource
win10-20220901-en
Behavioral task
behavioral2
Sample
https://docs.google.com/drawings/d/1YIYAoLNbk8ssJNGma4kD3WEjTxX8M8BqzXUQqn_4XcA/preview?234062643247775417571081108326430885331341663
Resource
win10v2004-20220901-en
General
-
Target
https://docs.google.com/drawings/d/1YIYAoLNbk8ssJNGma4kD3WEjTxX8M8BqzXUQqn_4XcA/preview?234062643247775417571081108326430885331341663
Malware Config
Signatures
-
Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdge.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdgeCP.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\rtcpal_registry.reg MicrosoftEdgeCP.exe -
Checks SCSI registry key(s) 3 TTPs 38 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C MicrosoftEdgeCP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 MicrosoftEdgeCP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\000A MicrosoftEdgeCP.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName MicrosoftEdgeCP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A MicrosoftEdgeCP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 MicrosoftEdgeCP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 MicrosoftEdgeCP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C MicrosoftEdgeCP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A MicrosoftEdgeCP.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName MicrosoftEdgeCP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 MicrosoftEdgeCP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A MicrosoftEdgeCP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A MicrosoftEdgeCP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A MicrosoftEdgeCP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 MicrosoftEdgeCP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 MicrosoftEdgeCP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A MicrosoftEdgeCP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A MicrosoftEdgeCP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 MicrosoftEdgeCP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 MicrosoftEdgeCP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C MicrosoftEdgeCP.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName MicrosoftEdgeCP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 MicrosoftEdgeCP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\000A MicrosoftEdgeCP.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName MicrosoftEdgeCP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C MicrosoftEdgeCP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 MicrosoftEdgeCP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 MicrosoftEdgeCP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A MicrosoftEdgeCP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 MicrosoftEdgeCP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 MicrosoftEdgeCP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 MicrosoftEdgeCP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 MicrosoftEdgeCP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 MicrosoftEdgeCP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A MicrosoftEdgeCP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A MicrosoftEdgeCP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A MicrosoftEdgeCP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A MicrosoftEdgeCP.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName MicrosoftEdgeCP.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS MicrosoftEdgeCP.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer MicrosoftEdgeCP.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url1 = "https://www.facebook.com/" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "Microsoft Mark Mobile - English (United States)" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\airdropeth.site\Total = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\FontSize = "3" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\MigrationTime = 7bef3f1b21bed801 MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites\Order = 0c0000000a000000000000000c0000000100000000000000 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\airdropeth.site\ = "193" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "309C 309C 30A1 30A1 30A2 30A2 30A3 30A3 30A4 30A4 30A5 30A5 30A6 30A6 30A7 30A7 30A8 30A8 30A9 30A9 30AA 30AA 30AB 30AB 30AC 30AC 30AD 30AD 30AE 30AE 30AF 30AF 30B0 30B0 30B1 30B1 30B2 30B2 30B3 30B3 30B4 30B4 30B5 30B5 30B6 30B6 30B7 30B7 30B8 30B8 30B9 30B9 30BA 30BA 30BB 30BB 30BC 30BC 30BD 30BD 30BE 30BE 30BF 30BF 30C0 30C0 30C1 30C1 30C2 30C2 30C3 30C3 30C4 30C4 30C5 30C5 30C6 30C6 30C7 30C7 30C8 30C8 30C9 30C9 30CA 30CA 30CB 30CB 30CC 30CC 30CD 30CD 30CE 30CE 30CF 30CF 30D0 30D0 30D1 30D1 30D2 30D2 30D3 30D3 30D4 30D4 30D5 30D5 30D6 30D6 30D7 30D7 30D8 30D8 30D9 30D9 30DA 30DA 30DB 30DB 30DC 30DC 30DD 30DD 30DE 30DE 30DF 30DF 30E0 30E0 30E1 30E1 30E2 30E2 30E3 30E3 30E4 30E4 30E5 30E5 30E6 30E6 30E7 30E7 30E8 30E8 30E9 30E9 30EA 30EA 30EB 30EB 30EC 30EC 30ED 30ED 30EE 30EE 30EF 30EF 30F0 30F0 30F1 30F1 30F2 30F2 30F3 30F3 30F4 30F4 30F5 30F5 30F6 30F6 30F7 30F7 30F8 30F8 30F9 30F9 30FA 30FA 30FB 30FB 30FC 30FC 30FD 30FD 30FE 30FE 0021 0021 0027 0027 002B 002B 002E 002E 003F 003F 005F 005F 007C 007C" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "%windir%\\Speech_OneCore\\Engines\\TTS\\en-US\\MSTTSLocenUS.dat" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "285" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "0" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "395205405" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\airdropeth.site\Total = "193" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "{BAE3E62C-37D4-49AC-A6F1-0E485ECD6757}" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 010000005545bb60c5625e6c6f8693f55ea788e2ada01b9bc9a07b676adcc0828675b1473cc6ceac0e801939914e019ba39bb11c5e83fd1bc92af9df20d5 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\ImageStoreRandomFolder = "coub626" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\airdropeth.site\Total = "29" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\airdropeth.site\ = "772" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\airdropeth.site\ = "1019" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\NextPromptBuild = "15063" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "SR en-US Lts Lexicon" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\airdropeth.site\Total = "104" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "404" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\airdropeth.site\Total = "253" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\UUID = "{681810AA-D27A-4323-8CD6-471355A1373F}" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\Voices\\Tokens\\MSTTS_V110_EnUS_ZiraM" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState\EdpState = "0" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\airdropeth.site\ = "78" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\AudioInput\\TokenEnums\\MMAudioIn\\" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "{0B3398EA-00F1-418b-AA31-6F2F9BE5809B}" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "%windir%\\Speech_OneCore\\Engines\\SR\\en-US-N\\r1033sr.lxa" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Zoom MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\Total\ = "0" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "409;9" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\CortanaVoices\\Tokens\\MSTTS_V110_enUS_EvaM" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\Recognizers\\Tokens\\MS-1033-110-WINMO-DNN" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\airdropeth.site\ = "225" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "- 0001 ! 0002 & 0003 , 0004 . 0005 ? 0006 _ 0007 ^ 0008 1 0009 2 000a ~ 000b : 000c a 000d aw 000e ax 000f ay 0010 b 0011 d 0012 ch 0013 eh 0014 eu 0015 ey 0016 f 0017 g 0018 h 0019 ih 001a iy 001b jh 001c k 001d l 001e m 001f n 0020 ng 0021 oe 0022 oh 0023 ow 0024 oy 0025 p 0026 pf 0027 r 0028 s 0029 sh 002a t 002b ts 002c ue 002d uh 002e uw 002f uy 0030 v 0031 x 0032 y 0033 z 0034 zh 0035" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI MicrosoftEdge.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1460 powershell.exe 1460 powershell.exe 1460 powershell.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 4312 MicrosoftEdgeCP.exe 4312 MicrosoftEdgeCP.exe 4312 MicrosoftEdgeCP.exe 4312 MicrosoftEdgeCP.exe 4312 MicrosoftEdgeCP.exe 4312 MicrosoftEdgeCP.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeDebugPrivilege 1460 powershell.exe Token: SeDebugPrivilege 2940 MicrosoftEdge.exe Token: SeDebugPrivilege 2940 MicrosoftEdge.exe Token: SeDebugPrivilege 2940 MicrosoftEdge.exe Token: SeDebugPrivilege 2940 MicrosoftEdge.exe Token: SeDebugPrivilege 4980 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4980 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4980 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4980 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 5040 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 5040 MicrosoftEdgeCP.exe Token: 33 2196 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2196 AUDIODG.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2940 MicrosoftEdge.exe 4312 MicrosoftEdgeCP.exe 4312 MicrosoftEdgeCP.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4312 wrote to memory of 4980 4312 MicrosoftEdgeCP.exe 73 PID 4312 wrote to memory of 4980 4312 MicrosoftEdgeCP.exe 73 PID 4312 wrote to memory of 4980 4312 MicrosoftEdgeCP.exe 73 PID 4312 wrote to memory of 4980 4312 MicrosoftEdgeCP.exe 73 PID 4312 wrote to memory of 4980 4312 MicrosoftEdgeCP.exe 73 PID 4312 wrote to memory of 4980 4312 MicrosoftEdgeCP.exe 73 PID 4312 wrote to memory of 4980 4312 MicrosoftEdgeCP.exe 73 PID 4312 wrote to memory of 4980 4312 MicrosoftEdgeCP.exe 73 PID 4312 wrote to memory of 4980 4312 MicrosoftEdgeCP.exe 73 PID 4312 wrote to memory of 4980 4312 MicrosoftEdgeCP.exe 73 PID 4312 wrote to memory of 4980 4312 MicrosoftEdgeCP.exe 73 PID 4312 wrote to memory of 4980 4312 MicrosoftEdgeCP.exe 73 PID 4312 wrote to memory of 4980 4312 MicrosoftEdgeCP.exe 73 PID 4312 wrote to memory of 4980 4312 MicrosoftEdgeCP.exe 73 PID 4312 wrote to memory of 4980 4312 MicrosoftEdgeCP.exe 73 PID 4312 wrote to memory of 4980 4312 MicrosoftEdgeCP.exe 73 PID 4312 wrote to memory of 4980 4312 MicrosoftEdgeCP.exe 73 PID 4312 wrote to memory of 4980 4312 MicrosoftEdgeCP.exe 73 PID 4312 wrote to memory of 4980 4312 MicrosoftEdgeCP.exe 73 PID 4312 wrote to memory of 4980 4312 MicrosoftEdgeCP.exe 73 PID 4312 wrote to memory of 4980 4312 MicrosoftEdgeCP.exe 73 PID 4312 wrote to memory of 4980 4312 MicrosoftEdgeCP.exe 73 PID 4312 wrote to memory of 4980 4312 MicrosoftEdgeCP.exe 73 PID 4312 wrote to memory of 4980 4312 MicrosoftEdgeCP.exe 73 PID 4312 wrote to memory of 4980 4312 MicrosoftEdgeCP.exe 73 PID 4312 wrote to memory of 4980 4312 MicrosoftEdgeCP.exe 73 PID 4312 wrote to memory of 4980 4312 MicrosoftEdgeCP.exe 73 PID 4312 wrote to memory of 4980 4312 MicrosoftEdgeCP.exe 73 PID 4312 wrote to memory of 4980 4312 MicrosoftEdgeCP.exe 73 PID 4312 wrote to memory of 4980 4312 MicrosoftEdgeCP.exe 73 PID 4312 wrote to memory of 4980 4312 MicrosoftEdgeCP.exe 73 PID 4312 wrote to memory of 4980 4312 MicrosoftEdgeCP.exe 73 PID 4312 wrote to memory of 4980 4312 MicrosoftEdgeCP.exe 73 PID 4312 wrote to memory of 4980 4312 MicrosoftEdgeCP.exe 73 PID 4312 wrote to memory of 4980 4312 MicrosoftEdgeCP.exe 73 PID 4312 wrote to memory of 4980 4312 MicrosoftEdgeCP.exe 73 PID 4312 wrote to memory of 4980 4312 MicrosoftEdgeCP.exe 73 PID 4312 wrote to memory of 4980 4312 MicrosoftEdgeCP.exe 73 PID 4312 wrote to memory of 4980 4312 MicrosoftEdgeCP.exe 73 PID 4312 wrote to memory of 4980 4312 MicrosoftEdgeCP.exe 73 PID 4312 wrote to memory of 4980 4312 MicrosoftEdgeCP.exe 73 PID 4312 wrote to memory of 4980 4312 MicrosoftEdgeCP.exe 73 PID 4312 wrote to memory of 4980 4312 MicrosoftEdgeCP.exe 73 PID 4312 wrote to memory of 4980 4312 MicrosoftEdgeCP.exe 73 PID 4312 wrote to memory of 4980 4312 MicrosoftEdgeCP.exe 73 PID 4312 wrote to memory of 4980 4312 MicrosoftEdgeCP.exe 73 PID 4312 wrote to memory of 4980 4312 MicrosoftEdgeCP.exe 73 PID 4312 wrote to memory of 4980 4312 MicrosoftEdgeCP.exe 73 PID 4312 wrote to memory of 4980 4312 MicrosoftEdgeCP.exe 73 PID 4312 wrote to memory of 4980 4312 MicrosoftEdgeCP.exe 73 PID 4312 wrote to memory of 4980 4312 MicrosoftEdgeCP.exe 73 PID 4312 wrote to memory of 4980 4312 MicrosoftEdgeCP.exe 73 PID 4312 wrote to memory of 4980 4312 MicrosoftEdgeCP.exe 73 PID 4312 wrote to memory of 5060 4312 MicrosoftEdgeCP.exe 77 PID 4312 wrote to memory of 5060 4312 MicrosoftEdgeCP.exe 77 PID 4312 wrote to memory of 5060 4312 MicrosoftEdgeCP.exe 77 PID 4312 wrote to memory of 5060 4312 MicrosoftEdgeCP.exe 77 PID 4312 wrote to memory of 5060 4312 MicrosoftEdgeCP.exe 77 PID 4312 wrote to memory of 5060 4312 MicrosoftEdgeCP.exe 77 PID 4312 wrote to memory of 5060 4312 MicrosoftEdgeCP.exe 77 PID 4312 wrote to memory of 5060 4312 MicrosoftEdgeCP.exe 77 PID 4312 wrote to memory of 5060 4312 MicrosoftEdgeCP.exe 77 PID 4312 wrote to memory of 5060 4312 MicrosoftEdgeCP.exe 77 PID 4312 wrote to memory of 5060 4312 MicrosoftEdgeCP.exe 77
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell start shell:Appsfolder\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge https://docs.google.com/drawings/d/1YIYAoLNbk8ssJNGma4kD3WEjTxX8M8BqzXUQqn_4XcA/preview?2340626432477754175710811083264308853313416631⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1460
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2940
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:4636
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4312
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4980
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5040
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x3cc1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2196
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
PID:5060
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:2472
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\0D8G1JRG\animate_volna[1].js
Filesize57KB
MD5d4a3412ea18727a6da26877e7108faa6
SHA1553cb78907c0e304a5c54b9e260cfb60b1f1c0cc
SHA25655918878dcbf2f6e359ddd6f0f4e1f2c1226628c85e82ad14b701658aa1721d9
SHA512cb093f6c832f4985d4e544417d93b1660dc9cd107cfa77a50b9de9ffbe39b5070988863f3748480f06453d7fe25c99f53b43214a40cfdcf4d8e61a8af47450db
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\0D8G1JRG\clock[1].js
Filesize1KB
MD5bfbe22434dfd2e72eca56419d0ea8fd8
SHA1759ac740b732aaaec07a73a5aa56f0e69ab97523
SHA256731da7655e7eae2f3b601822d20f7df53c9b7884a1a9644ae1f316acc61c5480
SHA512d6682dbbf59483582cc050722aa82d479816765d56bb97e2f45a32ff5b014be15ff4fc3a14e2d3ac06b5969c51bc01834d17194331d23ddf6e83109c5d94ce0a
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\0D8G1JRG\ion.rangeSlider.min[1].js
Filesize40KB
MD54f764e32c97096658d0c10c875a2f0ea
SHA1961d52c0cdf1a3d7d66709f12982fb4ee79083d0
SHA2569d1c3b96827f8477ad09bbc49c7332aeb334f5804b0226bda5e2aaf4de18de52
SHA512c1c781d67903740827bfbfee96eb9465fa4e47e9238f7ef0c41ca49440a46547a5238d2d12535d2c67a9f9b702b69318997e68ca0914b8e11a6533b5a8de2478
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\0D8G1JRG\jquery.ddslick.min[1].js
Filesize6KB
MD5184be2fe4d81e993edd6b83df628e24a
SHA1575b8e26ae888e1b2112b9584e46edc38417ad88
SHA256c75e8fec2327275e9dacbaa3414f4b2b0a470a4f1cb4f263f57bc96c3c8d365b
SHA512a50e259136c99bab26870cd30f5436f8a9d14b7aab0700dfea87ac308df123c19bc3ddd4745770ec342bd3cdaa3a1546308c9ad340062b412b747d2c05de4810
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\0D8G1JRG\jquery.mCustomScrollbar[1].js
Filesize93KB
MD557588d6c5af928b76c29953ea70fa270
SHA19b8c083a3c4981bf1cbd6594c6089994ffe8823a
SHA256468dab8f89d712d629dca469eb74d3931bb13336ba4e389afa59125aaf21362f
SHA512bb9be6149ca5ad61453f4772a728c87a1bc1e85e5067e3909eacad7ca46ff26b4b39bf8648ca1a763044839318eadaa4961a4865136579b73ec54025a80c6ae1
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\0D8G1JRG\modal[1].js
Filesize3KB
MD5880e4ebf2e1fbe4ae66d8ac1345805f7
SHA1283e168d5e3010a41de9571fe784ba22fdc1af57
SHA256c06ede0537e973d29f92bfe863d29773e00cca0c0d79a4d6708bd1bee05811a6
SHA512b3ab3e0a77b44d0fc470d632967cc34a6aaf6b63985e0a9afab10a1692bd4ec4ea2953df4f9d87d5d94f45427af7e9e1161a00f97973992d13f077b3db6f5656
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\0D8G1JRG\responsive[1].css
Filesize64KB
MD584ea6369bee06d3d85c5edf574e2afac
SHA14f6801beeda5133dba428cf48b6f632f0ee0c547
SHA25632c6d8c9d1a71e0a128e349ac61660e45c8f033ed861833b983009117c24a08f
SHA512ac3e78dc495461f7d57850fcb5695d8e634063e5d2c1cf3d30264b06f709958110f741ad019da51db1d0e2dd89bacad681afce114157a944e9774302a91938c2
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\0D8G1JRG\slick[1].css
Filesize1KB
MD5b06073c5a23326dcc332b78d42c7290c
SHA164e6c5ff99f14c65752e0322234160f8e83fc6c2
SHA256f0b722c48c52082cd77261574e22a5251fe37ea4b291b1441134145bab9b2063
SHA512438230129bd3bde621f9687d3e1739ac0a7ccd7b285be160daee2ae5395701e47d9c41b6a109c9ebb0f9b994c1058a5722362959098872a3094c11445800c395
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\0D8G1JRG\style[1].css
Filesize203KB
MD5bdc29fbfb065298ac487ecf76a1d1c58
SHA1772be6c038dc74a90ae9f60840a3f2d932a7166c
SHA256570f7b0c4955f41d96eb5cc074badf52668ec26a075dfa07185bd5e6b3b481e0
SHA51224f0baa20e7c270fb5b18cab37cf66697f96784dd67c4d0117aad47366b48ec5262aaaaea88b83d920a6bc7c698b5ed2f0641fb8f8a5b69fd4f27c92ae47a415
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\276AOTX8\clipboard.min[1].js
Filesize10KB
MD58bdf3c870505793a19055d826841b204
SHA1c49d77902f67226abd9c1ea0a0ede6422149a3df
SHA256cbfd5114d4a1be90ea27302bc4c1c696acd5e8aa606c79b355a5c363df189241
SHA5128eb9a897c56785474a5cbae9a5fd56090c57ced2c3fa12f1a3d4d110f3b076e083298e526c7c64bad3e08696d668df58c6ed1fdd9e70de135342d0ccba7366e3
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\276AOTX8\jquery-3.3.1.min[1].js
Filesize84KB
MD5378087a64e1394fc51f300bb9c11878c
SHA10c3192b500a4fd550e483cf77a49806a5872185b
SHA2564fe68fa216176e6d1f4580e924bafecc9f519984ecc06b1a840a08b0d88c95de
SHA5129a2c70516ea0c8c37c7f072f214de0afd5ddeb643c6b5d3fa8ade3ef8d2ce40bdf8b1b1194bad296e9075562701ee7dae48b18144b1cd2d735328be5a3accbe6
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\276AOTX8\jquery-ui.min[1].css
Filesize34KB
MD5dc08925750c9bce57f7ff5a075cb665c
SHA1a582c18fbac6555611cc5f85207e58e345ed26a8
SHA2561d7f3dee181974ed56c8173d4a2e03375378e417b480f3c706090a1fdaaaa590
SHA5122db1d99c65a2bd54ab739e8462cc23bc28d3a0c841f3d0854db47ba14df5f6872cf59fe335f5ee0725d01637bec674f423144a4540c71a6cc9d7981c7e2d05aa
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\276AOTX8\jquery.cookie[1].js
Filesize3KB
MD5d5528dde0006c78be04817327c2f9b6f
SHA131e1bcc4cf805a2c2fee21f48ded1e598f64a2a8
SHA256b84161c9fbf7520cd14e7019f92120bd87a928a074156e91a992eba9fc9436e8
SHA51269484bdb1382ae92c4b860f97fab601db2d8117469619f06e720fe5a516b5eb3f2d88ad6065bba6e28790bd1faa86b20aa753a9a0c7a2ad53c4eb787a404a9af
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\276AOTX8\jquery.mousewheel.min[1].js
Filesize2KB
MD5d5843dbdc71ff8014a5eafd346a262da
SHA1127e1d971efab9341db8079f10663dc28e8e0a2f
SHA2568e73a30d35c83ea6a597c3343324d2b7df097ad26e67b62efb5266ee12d317b5
SHA512ac28dfa1a6fd09528e1ffc3f4fa19b0719c01f9033872e3eab51175b95c451179f1db22445b43ef9947e1810a5a37fdddeae7cdd7fe03b814a98e16e8642ab74
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\276AOTX8\pic_ETH[1].png
Filesize41KB
MD5d56c98c8fbae62b037d3c6a6b04870a9
SHA156a6fe565c1b1e1b1a8cc1b8a2467e300c747bed
SHA256e93457832c5f18e91a3f8aea48584ea754b934d4b1d53a98b50b62e1c9b013ea
SHA5126ec4c038f4b50f75de1cea8985e6caf17f6ae491e2ea3494fae2e23ab61dfda170ada752df6bbde5817312da01e30305b9f037c4b577bd78c9723867a511e25d
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\276AOTX8\selectric[1].css
Filesize4KB
MD54761f1b8ebf0745086324803175bb1df
SHA1dfd0ebb391be97ecfe0105bd9efd6c874b59087a
SHA2566469b368b34b9622b5f2316c8e16eb7e3451836effe6ea2283695dab39e1f83a
SHA5121340aa66599d2f31a65906d4fe9db9eeeedbb3c76ee39ef2a0a54ca6a7d5c6ce63fe4cf9db11f22be4df65d324b386773e695018944af78ebdbaf201ef4ce371
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\276AOTX8\style[1].css
Filesize3KB
MD5476d08bf466c747ffd92a27ad6b72add
SHA1a23ce904db4a285d0b002500071824e0bababe05
SHA2566e50695b8842f26e22b13d58fa42129c62dbcee39d404b17904d9eef4d3afab0
SHA5129f199a4a947e0e7dcb59cdac3b95ed18c6e7fb3176691c85c0e23e002376e7ad5035f7e449b2bb89150a82c0876bc56304050d7b655537cd97dbe7a19c69deb1
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\525124R5\NFT_NFT[1].png
Filesize1KB
MD54d90bf7e8ceb6346304cbf1cd6965e27
SHA12a3de2beaa1edec71a0a8cacd18201cfefdd3b74
SHA256d6c188e20b27253d24b9794447764402bee704777ec919e62aa059b2c1c417ef
SHA512464373876d6e72986fef8af9b3e2d84e177a2980d636fd567ac8cf27a90cafd4a161e449f2f8ed6816963ba3abccc8edf696979cab72f01ded9c1d47a56a0acc
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\525124R5\arro_left[1].png
Filesize317B
MD5e671c3e6afe0ac9ac60488714b01b22b
SHA1ebc22fb3355c68a5ace57b5c07b98a96c181e3b9
SHA2563961b34c018fc765990651e95c4bb1e24055676ea81b9a63ed1aec0f407a2bef
SHA512617f9b5cb66d020f742d7ddefdfe40ef05628558b3bbfac74230438ecd6b840a8b638672cd15b26f7c08d797e242707b440bc81ab6f15943f3b630f88441b5ea
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\525124R5\arrow_right[1].png
Filesize312B
MD56e81c4508f4c90ccf2f124f415891fa4
SHA12eef8118703c661e0d8c66d3c3ba6633d5811a02
SHA256435c9f6d355842f2929e5d1e7a68e2fb2088ff94837552bb4c19eae30edadfd5
SHA512e3a0b293a157eb045a52f31b035f340d8e16350b78706e61df77f875d9d706ea710314b7495802fbb414d2442ff1503d59617d555272180512df608656e85698
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\525124R5\bghistorygretting[1].png
Filesize35KB
MD5839f41448c5d3c17873fdb416de05619
SHA161e42fba13908c7e4770c98f254068923a4b85f7
SHA25679115c5ef4666b125359abc5ebf0f51fbf5777248f6b168740a830792e23d4e2
SHA5127b88fbed2d9a2dbe1d54afb423ab453e129289695a2d21c8b872f90dfcb137fcd048823749292f871c245788d8831764785f4eeef8b708ddb9c4226305cdaa02
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\525124R5\bgstars[1].png
Filesize16KB
MD51c7e2106ad4135e08511dad82137d9ca
SHA12e4927ec794acb05abba71d89d56c043832909fd
SHA25659614291ced077b0b974f7b1be9afd7c22374d4ae81b01164cf24d4d8e326bdf
SHA512ac59f090922bc1de1cbd3e7c63d55fcda9f35914f308f296f28f413a4baa4afeea8e4e789fbf4c7a27d023053dbafbd0b7b2b8b19848dc55040273927dd68539
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\525124R5\bgwhyslide[1].png
Filesize18KB
MD52e47a68219f63077ad0fd9af7564e0b3
SHA1b81c3caef674a76daa71cbbd4eb3020ae5d96712
SHA256c8d19963dc98e99899e18b0da9f475a9f9373272f92ca046a1f9d6eafdec388b
SHA512e1ee4b9531cf073d4f5ad0a7b5620d3f1de2e1c4bfd46fe4d3b91219b35fe9fb75e0bdbf2975f413e1144d81d3335945e0d8d0eca3f8b65eca26bc7fa2c2ffc3
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\525124R5\ic-circle1[1].png
Filesize451B
MD5fd6cb7077ec116c84cedf3ea9e384a35
SHA1b8e3de507c7aa73314987524de2d2d0c957ad516
SHA256a34706fa9db68274e4d146192af9ce24a88615ba22028faab5cd7d9c450dd526
SHA5128f05e2d49e085f885471a6d24ebabbf7c31503dd381f2aa294eb64105db6a5af8349f824588b86889c7b9251e38646867bbb521c1facfdd94a2f67f93f653806
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\525124R5\ic-circle2[1].png
Filesize400B
MD512a33441bc1108913a795125ee18e249
SHA1f7fd9abb81e215def51378665416dc99202afde0
SHA2561670604283f2c1f862bf4c20cae27c75cb0958378f9850cfb78ab47454da0730
SHA512d1a85d3186b64c7f006764b339c3e356336e6aab5b8c6a15beea7f5bad49ed138d08072ccf1a80376d9d9ac7d3f526d19d2beaba84943d43f4f6b41c7de83a74
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\525124R5\ic-circle3[1].png
Filesize288B
MD5d21019428ee2beb0c8af53b462f46480
SHA1bfdcbbf03615ebb50d9fb2ef496a2b318bca5699
SHA256208a0093c084e8ff61c5dd5b6e534d1cb30edfbb31c1699ac0ed49eb20450364
SHA512f97e182f573884537905b63bb19dd9216e3365057fcdef4673dff22cf92fb8007b36ef664b8f07e87d2a91a26d9efa4949dbc84d85e2dc2eebffa700d765c684
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\525124R5\ic-circle4[1].png
Filesize416B
MD50b94b18fdafe28ce5b73c097282689a9
SHA15ad4ab276b0fe176946aa7b3fbe5820944753932
SHA256148da0c55a88f3a9be4ed9a3ea2b45db975f5575d388e6059682bf7eae21cb8e
SHA5123da6e994195866be2a80be7416689ce49d178dcaceb7d92acbc101abf95c98f6ca8e719a477e167076afafeb9a082c4c11b558d393a6b3da214c937f013e9855
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\525124R5\jquery.selectric.min[1].js
Filesize14KB
MD52b6e25e88d8be2bdd721149e7f466902
SHA13c88faa365a3118d5eee39e0b35014aeb4ccb748
SHA2568231b21e96dccb08ff8fe34d9eed80bb102bc43d9802c44b1b7a4e74165483fe
SHA5126ca6da78dd3532daaf0a8aa685300332d46a6022a4b58b0c79c933a55b6472b0b8438bb44f14218a62b07745848e18d0c6b95f1b9197601a41a1c70b707cc605
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\525124R5\logo_big[1].png
Filesize4KB
MD5019d8eb2c9f0a9b64cc46375d0bee707
SHA1cc776b3b478128b7806ab82093096fe655ebded7
SHA256e2f162d1d6198bc991e0078ba0d65265e94b1e1022f7eb7125709a1ff8efca8b
SHA512acfb770e6748a38254d26d8de7ad07eb8459fbd9465bbb7a3e764680b5feb27ea38a43a11212ea9c9706c1246d0440e342da2ba722fa347b6a478ac687d004b2
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\525124R5\slick.min[1].js
Filesize41KB
MD5777da4aaf5b960636dec0fd4e50ba489
SHA19a94038ccae90e6d2a0f9cb61f79ae7c70320287
SHA256e1a52c0a06fa9f65e015b02e7ec463fd621211a9d2ae44b6660597900e927fbb
SHA5129b810776ff98b94fe765b192187064d2ce4921fb60baf4c797c3302d332f7e55556e54eb070cc8917f61aa74191539a294457aa18d54f5e85527652695c6f848
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\5DCQ6OAT\ETH_ETH[1].png
Filesize1KB
MD57f76eaa5d778e3543e3c029fa8629f31
SHA1b3810a99add03abbdb2d21b812a0c4a20cf06be5
SHA256c7e64442a29c6135a97acc6f5d4d0091a9d76af1637b819582bb02c7cd8a75eb
SHA5129dd8c370295364e6c0a60ce123ebd2c6b8c192bb7773d4fb9f8c88394d6dd12c70e68ec89755315c6ae5b23f5ca3b07968d157f5ff7e6badb8c8b4b2fce70af4
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\5DCQ6OAT\bginvide2[1].png
Filesize145KB
MD5a8b75432d0a2545e54ec0008351eeff7
SHA1308744c35a5a193bf7b790714e2b465f762c88f1
SHA25695701b71900d4141083ece883fd31d765e9ad0fba761301ac97a6f794dd87dfd
SHA512484883e6dc2654e2d677bd71370b0a3bb09e025484b2eef1ea08f34128e2b7d5c7755731d657795492a098ec8e92ccbb35e3ced1a120d81560fef8f0920b9223
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\5DCQ6OAT\bginvide[1].png
Filesize17KB
MD5e965364f1b271d981238637cd0ae5248
SHA1ee223aa4a215d43e6d8a944d04a631c0db70a263
SHA25668bf17a68343c6b1d7e3c3709276739328a4552121a9c6e6f9a95ab191c14005
SHA512f41794e7b6977ec2462924bdd2f86c26b3b86b328c2a44da5e335c056077f94fb2691e0b0328ce7d97fef3f9a940fe647cef685addc0db09a56f50933dadadeb
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\5DCQ6OAT\bgprogram[1].png
Filesize120KB
MD5d99495d2fa8cdc8236b6a45ccba3a914
SHA10ae95727ea15b0d639b00ff4c7658be5030ad696
SHA256c879c4395ccd0b6bea520d42d9a25a91387930880b14de3160c27e6ccf2aa528
SHA5129eb66c27c7f4981bb83c0d102390aa6d5df45c10634d0c0da6883a444f3a619baa903bf9586b6fd19ff1aa75b3df135fb2606df94fc0fea8daecf7e621860bdd
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\5DCQ6OAT\bootstrap.bundle.min[1].js
Filesize78KB
MD59afc1e0eba9521f29775ad2f6ace3f1f
SHA177bcf0c882fa4be8fbead35052c39a944f9035e3
SHA256a85b2fe307777c8eb47f06a1eec399fcbddfe83d252fd202d3e1358051fcf27d
SHA512d532b8863098e7e13d1f7af9fb4e5b1066ca1b22b9d3a59a0cf7cf7b5b3f8a1c118ebe8eb4be37cc92f338543eff372238d11dfaca7b2f0adf3829f2ba43d2b2
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\5DCQ6OAT\bootstrap.min[1].css
Filesize190KB
MD516b20908101acc6624cb9446fcac64a1
SHA1b7cd57a4fd6a1fae6126150f427ef217397293e4
SHA2562933c96348a4eae7cbbf8f280ca0981586a9b5c097ef952b996cad7d28f2fad0
SHA512b22c1efe85cc8528c60b02e7fac72b68f396ac9c4795480c04c65774f7b64e7937234c771120a82f3ed66793531fa499af2c0c63e3c1d5c8f2a89e63025b823a
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\5DCQ6OAT\detect.min[1].js
Filesize25KB
MD5e0924d3db172fb414da2b33d2a054d85
SHA1584be445c90279ef8dba1da58e6201fbfe1fce89
SHA256a26201ba6964e3ae8e0b1572ff108ad5be19badcb75fb1fa890d590d4bf5196e
SHA51270d73c4b058708fd3c1aabcb6d55ae5f51ca5e69577ce092b618ed41a78ff103119e360c65d9b57c9cc9e2290ba43dbee875cf4703cb3fa8328ccd1ef0adb77f
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\5DCQ6OAT\fonprogram[1].png
Filesize22KB
MD572fa2f77925daef98fe23fd11758a795
SHA1bea3a8a4230e8c8d04b8f9fbd29aeceb94ea779d
SHA2564f65cd055830d77c8709d28c70d28196cb9d99fdb73623464e529ade289f7530
SHA51260188d286862ab18ea2f94cd7325a6f21115a0467348ff2828040aac56ea09e693cc30574ebc34c1f192c81130ec380f583ee89786a35c3455dd0fdd389e815d
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\5DCQ6OAT\history[1].svg
Filesize1KB
MD5071c485f6a8850c598030ce749572a49
SHA1efd963a87c7ab8561a5dab227ba16ec7e20f21ba
SHA2563760c71404d0928534b4077d4ee92d9b4cf9f72b766a6e8cd45bfa73202c3781
SHA512a800389a9cdc22c0239d8438dddd80d1c395e1783beb17d55fa336da2af15ee9518d43b3d38310f55f49263e48e0d0affdd0475be70df4d34bfbd986d7ef03f1
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\5DCQ6OAT\ic-invide1[1].png
Filesize11KB
MD542429f7d3afbe453f43da271db6164de
SHA12fb1e807bb56ca8537997a6ffac71f889573a640
SHA25687531c67cf7faa9ebacfbc71d6060fbba05d45f93d0b0667f2f11ee76855c0f0
SHA5120f6e88914f09313c989fc83d2e2b2f26acbd761ed5a7f547c71b6aab79cfc9aaccb46b1995e21bef07fe2daff3f2d578883b26edcb4f881c0756037549337ed9
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\5DCQ6OAT\ic-invide2[1].png
Filesize11KB
MD56d50be251ea00d188f34ea10526c4b0d
SHA1e9bb938f186b4e639c6d48c2c50764c414892256
SHA2567d261ad1c0bc3944916ad0f44011c5ae3344e15ef6b2df742a44764b27a1d0d7
SHA5129984f7e8b7fab0590cedd96b8033cd81543fc587e5d88d291321297bb28ac76e80f450d1d071f11d7e8191467e41bc9ba52296f1f223b61beea40b01326f1652
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\5DCQ6OAT\ic-invide3[1].png
Filesize11KB
MD5f9febf945bc2daeafe804b68cdaacb81
SHA11e33ebb8414d52e5772b5be9c6265c62b4f9179d
SHA2569ba87e48e69a88a2f0aaac81911ec51fd31abe16525cd372a1aaa1b9c49e66db
SHA51237e2ee59ba79087e20515a3ac6b0130106ac533a9ee67841d9ef6b5435ddb61eef027b14f7ed9373fba740fef67b90a3d6226740487ded75b2defa808e122f9e
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\5DCQ6OAT\ic-surprise[1].png
Filesize463B
MD56fd706cd66a3a84931d2d1dfcb54d47f
SHA1aeac49e0205078933e48248dfd2bad57164efae6
SHA2563bc3fc6ed5558aed768285df53edf36c87cbef761f4f48ede3090faf6e7cdfda
SHA512410cd51f1db7bd908e2ff3058ee269d64bb1252cec4cc86cd1e50de5193233db9005c6b6fb133ce1e5d39d1a0afdbf780025d9a19b25d86794f72d5a29ebbe42
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\5DCQ6OAT\ion.rangeSlider.skinSimple[1].css
Filesize2KB
MD5c53c14100c076ea318cf30c285b4a0aa
SHA1f5c1219ee32b33207894edf4a3b5071fa3885b44
SHA256271d327a5d275a70c5fe479f8e7a1da76ec8b550cd0bac34ca580ad049e292e3
SHA512745692a5c7f2ecf227b3273f0c3d1a137f9886f1dadb5ac39671c20823049dd758a34d43ba1b7d95e9ccff4cbef53108ecd54eb4d22c2f27354c87635759f36d
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\5DCQ6OAT\ion.rangeSlider[1].css
Filesize3KB
MD5f5069b36da2397d9f5a85411a2eb2bec
SHA1d665f3a2ed4984b74b27c9cc1d8861871e91b7c0
SHA256fb3e85576e662d2b8afe16d00d9de193303185e8e41e99d2ee749199852c4d0f
SHA51293e950351f76842255620ae6d1547dbc93ddbb02470ccea2de0392096ce285d2b46e44aa991653a7c734252ee571ab49ac42d51ebdeba35ad04412a1a16e07d9
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\5DCQ6OAT\jquery-ui.min[1].js
Filesize247KB
MD591aae8d088d15784a7c34b31c2e03266
SHA1e2fae2a00154a5d5f54199b0d1a460e58113eef2
SHA2569a7defac2a6b80fb11a7c72dead382689eb9fbae12254bb0ee20928b8506a6fa
SHA512fde69cd5ed532b44423e57fd9e9b9608037d8a978f3e9d5c87b5e34baf978818e0cdd655d8273e38a773c938e83b32646df81d11a5f727ae593df262fc4a956a
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\5DCQ6OAT\jquery.mCustomScrollbar[1].css
Filesize53KB
MD50498d93dd0e0aa76c429ffa83c0e2af1
SHA1c769effd9e01fb581e8eabc2b2df6dafca253596
SHA256604505743a2e649765ce6a1a24fb8e902efa1525e5b1cf6f91b6296f68ca138b
SHA512d602dde0482da806adbaeecd02b5b6140b88a80a63a7059bb8f99233369cb0b95c0c4113918eef47844eec8dee792eb2313fc505fe0103d3e05ca2ca480462a1
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\5DCQ6OAT\script[1].js
Filesize25KB
MD5e05c5cdc288e4ca4aa25d7b3a05eab1b
SHA1546d46c07706d7d3bb88d6ac18ceac1b1ce60128
SHA2560f75fc46a2dded23e8b349c04824e468c9b301173026bfdcefc16ce267a19b24
SHA512c2201b757d084e6ae80ba66ee03af837471a296a8e95b4954e36829c1fc89faacd9592e841546361fd93ac7c1a467ddae147f427a11186fc47f9b16cd0e333e2
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\5DCQ6OAT\three.min[1].js
Filesize415KB
MD5235a02b69403b06093c0ad9df4987332
SHA14bdddf0a56e01ea060c760f58d8e22cec3b9984b
SHA2560e592b131d4506662e5e40170438c6c90c4d39b80ddd6ca8f426190eb8cae27b
SHA512c92498921318c36bbe0ca8280b9076ed2aa17af481817b73cc3b8ec625905c549b1ee8213d552c98903470622b7c097f39e15e4c52abb0672779d6e83345a119
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Filesize717B
MD5ec8ff3b1ded0246437b1472c69dd1811
SHA1d813e874c2524e3a7da6c466c67854ad16800326
SHA256e634c2d1ed20e0638c95597adf4c9d392ebab932d3353f18af1e4421f4bb9cab
SHA512e967b804cbf2d6da30a532cbc62557d09bd236807790040c6bee5584a482dc09d724fc1d9ac0de6aa5b4e8b1fff72c8ab3206222cc2c95a91035754ac1257552
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize1KB
MD55fa26a8653aac9e0783312ec73d88f99
SHA1ae0ac168ead60d0d6268b9921b18adac5366138b
SHA2564e59a08f04acb29642fab743dcefa9413f8e32abf3367fefeaee57f1ec7966e8
SHA5128483205371fe3e98fb64af8413758e2a0a0b4673b07a7255897f86ccbad5fe932e95b2ad5c1b5ac29f043c0b127e8d9eab1e7faf1ed1d20806967242f7b7b5bb
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\30E87F19AADFD89DCA026CF006552D83
Filesize503B
MD5e8e042df686557dba53591299dbd9f7f
SHA19cbd37203c5222e6a07663d824e5d8f2162889a6
SHA256d5fe7d5cc392c65fdc55885999f97d35b41bf0c0134dadda5649fdde67bd456e
SHA5120b265bdbb151d2940740bce51c5a63196dd4f6b570f66482534145ce680260296429c727d3444b86dc88a0d37d377abe54321bb766d7d4833dc01332d25ca990
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
Filesize1KB
MD56d98a7c15f9c1386546accd549dcc7cf
SHA1aa3914fbf4239efacb27f6af73409428628b27f6
SHA256b44a8dc448759475a0ddd3511e681623a19eb620e67a94ee83ef04c0d6ba7944
SHA5121c4d220a2012a26dd7e2d591af91c72ec4cb44fc80663941b64b82cc4cf74562f157ef1193783e2478cd75bcea7a5eba0a8eab753aade55070d9f4eb0ca963f0
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\9FF67FB3141440EED32363089565AE60_01461C31CF19B94E3FDAD3C6F70DA484
Filesize278B
MD5bf7b44db463d1c52d91936993d8e63bd
SHA16e5499cb1bfb645dc99ecabe709a03445f9a6e5b
SHA256b42db26c0875ef1c3b50c8b04b8962694b93f0446672481fac5b7a0c1db613cb
SHA5121ab428ecabc52477e20a725431b6b537129edfd08ac78ec1270c6d00a747ff6cf4dffcf35ea84b6ba56d6ef8fd63c3d042f0c5ce19eecc99dead1f226519a7fb
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\9FF67FB3141440EED32363089565AE60_33E6263BAF1D93C3B754E2140B85CB43
Filesize280B
MD5f0d4ddee855e5452cab5a275f37695dd
SHA1be58ad026ae3b6df4aa585595a4dbf5a966f8940
SHA25686ee6e48801a67829dc4930960ad53adb683a880c5a87677a7ab4fda258ab0d7
SHA5124ce0a965dcb70e4997de37d3ff5f87773a4ab6dbd09e4b8297a2475b79478ef653aa4d28f3fea9157313707b3a0efddfbbd8a233c02ddeae9a7815e52f0aecb0
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize724B
MD5f569e1d183b84e8078dc456192127536
SHA130c537463eed902925300dd07a87d820a713753f
SHA256287bc80237497eb8681dbf136a56cc3870dd5bd12d48051525a280ae62aab413
SHA51249553b65a8e3fc0bf98c1bc02bae5b22188618d8edf8e88e4e25932105796956ae8301c63c487e0afe368ea39a4a2af07935a808f5fb53287ef9287bc73e1012
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Filesize192B
MD5d6adc8e889d9ca82aa7fd3c8aa3a5f4e
SHA1551454b2d496b2f387fdf77a10b60b54c56287aa
SHA2564dead354b98dcc1ef37c34f602f19b6d18b559751356a768f50c4f0fb6295598
SHA5123dbf71c918b256fed4062bf0483c3d69d8e92623614b72a0d4bded2b70f4debd370ac5d69c4d3b7884e90d19f7148e9681f5e1f503c3ddae8eaf9f24991263a1
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize410B
MD5c3d6c97bd23bfd5a0953cc4e3d2e4657
SHA1145932303269d292cd0644e4f903cfedcc8f4b2d
SHA256b0f4a2d0d66c3e5a548eb5595e9564fe4b544ff29720c73fb1ee1d358c89f71b
SHA51232aa1b42bb971604e62c9aadc97a521fd6cde8e0e85389f95869d32243629722aa3fa64e6290e8728a745f42b36001742daf45718bef204d560a9d8d37f02772
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\30E87F19AADFD89DCA026CF006552D83
Filesize556B
MD56f5d4948555b64efdffbdc03f7543112
SHA1d4479639b3cfe059fe35d508592882fa1fb3ba63
SHA256d74df6689408c3df1f5ec5044b966423be559a022b0ef11d2a5aebd803f4c06c
SHA512fd458174de2df912026bb66f0b37410e9cbce87350004f9db07fc4a9686ee701adcb86c9a63cc6f95f2510e0c4dd18c6dda11b332d6aceb5c51035c54d8203eb
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
Filesize438B
MD5fc41b38cd5da9cf4cbafb7167e52cf7d
SHA1d8c54fb3e4a2bf6b744442377a71c72c7191a122
SHA2565ad2b96259e41b66b094df8c454af25625d9811930fd81f6db22df7574dc3db9
SHA51208ce03ff741e9de7746414143e7ceeb51a414fca08d80b6d2e2aea86e8c2dc237065f9037d1b3f3406d66596a8528d7257df3fc637531f685c993ee51f9ae065
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\9FF67FB3141440EED32363089565AE60_01461C31CF19B94E3FDAD3C6F70DA484
Filesize426B
MD5b06219a9d3cbcb47e4b48a00f3ed20b7
SHA1fbf6821b7c601eb07bcfbe7335bdcbd8f2aabf08
SHA256cd604657e6b497c6afbbbb64731521df45be62130d69fb05780275db4b533f0a
SHA512991162aa5f74ee48011e50b896260a60fc5b49252f3316d3985378f59dfbe470bed8d960dbad8e7335284b7f36fe3acdd051efd6bc05512b8c01fec11e29073e
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\9FF67FB3141440EED32363089565AE60_33E6263BAF1D93C3B754E2140B85CB43
Filesize426B
MD576beae5dfef9141bcfb08ad41da169ef
SHA1c0bdd8f508e9f2a180df6238fc97eec99eb21a4a
SHA25644222921832b1df70207123ad069e7b1d3c601d3bea15dcafd4bb51e784e61d7
SHA5121d305431a135eedb16d672665037cad89a9b861cc20013e75c84071af2430044291469129d882ee00391c6726c2a65c40471d233a3e75f74106f61d7bef05886
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize392B
MD5fbd00db12f30be9d1f7790f96b709585
SHA1f2470ebadddcf40fda81d338d3e05d638215ec3c
SHA256e1db30c4f217623d417225f3c321cdb1f13a7363a758818c5dd2003389c42386
SHA512c52ceb9955fcaf4b67f83df5f902f4d8c3b5cd8cc3cfe7f13da4590f53b712ad01e1502940da42968c086a995d910e542d9f6c362d36be74244d3a6ff907ebde
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\Windows\3720402701\2219095117.pri
Filesize207KB
MD5e2b88765ee31470114e866d939a8f2c6
SHA1e0a53b8511186ff308a0507b6304fb16cabd4e1f
SHA256523e419d2fa2e780239812d36caa37e92f8c3e6a5cd9f18f0d807c593effa45e
SHA512462e8e6b4e63fc6781b6a9935b332a1dc77bfb88e1de49134f86fd46bd1598d2e842902dd9415a328e325bd7cdee766bd9473f2695acdfa769ffe7ba9ae1953d