hxxps://payment[.]flywire[.]com/pay/payment

Analysis

max time kernel
67s
max time network
70s
platform
windows10-1703_x64
resource
win10-20231023-en
resource tags

arch:x64arch:x86image:win10-20231023-enlocale:en-usos:windows10-1703-x64system
submitted
13-11-2023 15:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://payment.flywire.com/pay/payment

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "8556"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\www.flywire.com\ = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLsVisitCount\url4 = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 52f714984616da01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com\ = "132"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\flywire.com\Total = "3021"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\flywire.com	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "268435456"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "4071"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\flywire.com\ = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\NextUpdateDate = "406654490"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\consentcdn.cookiebot.com	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\flywire.com\Total = "3083"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\marketo.com\NumberOfSubdomain = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Rating Prompt Shown = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\payment.flywire.com	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\marketo.com\ = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\app-ab37.marketo.com\ = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url2 = "https://www.facebook.com/"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "395205405"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "7244"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "6198"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\optimizely.com\Total = "1920"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "5080"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\cookiebot.com\NumberOfSubd = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com\ = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\Total = "23"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\a25231670039.cdn.optimizely.c = "2501"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListInPrivateBrowsingAllowed = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url1 = "http://flywire.com/"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\flywire.com\Total = "1730"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "8574"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\a25231670039.cdn.optimizely.c = "1997"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "4223"	MicrosoftEdgeCP.exe

Suspicious behavior: MapViewOfSection 8 IoCs

pid	Process
1144	MicrosoftEdgeCP.exe
1144	MicrosoftEdgeCP.exe
1144	MicrosoftEdgeCP.exe
1144	MicrosoftEdgeCP.exe
1144	MicrosoftEdgeCP.exe
1144	MicrosoftEdgeCP.exe
1144	MicrosoftEdgeCP.exe
1144	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	976	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	976	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	976	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	976	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4040	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4040	MicrosoftEdgeCP.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3972	MicrosoftEdge.exe
1144	MicrosoftEdgeCP.exe
976	MicrosoftEdgeCP.exe
1144	MicrosoftEdgeCP.exe
3552	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 2076	1144	MicrosoftEdgeCP.exe	75
PID 1144 wrote to memory of 2076	1144	MicrosoftEdgeCP.exe	75
PID 1144 wrote to memory of 2076	1144	MicrosoftEdgeCP.exe	75
PID 1144 wrote to memory of 2076	1144	MicrosoftEdgeCP.exe	75
PID 1144 wrote to memory of 1156	1144	MicrosoftEdgeCP.exe	78
PID 1144 wrote to memory of 1156	1144	MicrosoftEdgeCP.exe	78
PID 1144 wrote to memory of 1156	1144	MicrosoftEdgeCP.exe	78
PID 1144 wrote to memory of 1156	1144	MicrosoftEdgeCP.exe	78
PID 1144 wrote to memory of 1156	1144	MicrosoftEdgeCP.exe	78
PID 1144 wrote to memory of 1156	1144	MicrosoftEdgeCP.exe	78
PID 1144 wrote to memory of 1156	1144	MicrosoftEdgeCP.exe	78
PID 1144 wrote to memory of 1156	1144	MicrosoftEdgeCP.exe	78
PID 1144 wrote to memory of 1156	1144	MicrosoftEdgeCP.exe	78
PID 1144 wrote to memory of 1156	1144	MicrosoftEdgeCP.exe	78
PID 1144 wrote to memory of 1156	1144	MicrosoftEdgeCP.exe	78
PID 1144 wrote to memory of 1156	1144	MicrosoftEdgeCP.exe	78
PID 1144 wrote to memory of 1156	1144	MicrosoftEdgeCP.exe	78
PID 1144 wrote to memory of 1156	1144	MicrosoftEdgeCP.exe	78

C:\Windows\system32\LaunchWinApp.exe
"C:\Windows\system32\LaunchWinApp.exe" "https://payment.flywire.com/pay/payment"
1⤵
PID:1576

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3972

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4236

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1144

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:976

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:2076

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4040

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:1156

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3552

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\F01YT1OE\edgecompatviewlist[1].xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\5OM78W03\acf0d21bbd[2].js

Filesize
56B

MD5
2c0a27f2f5831b2c5d395cfb1c8f20fa

SHA1
f9bfe73d0f1597cc62bf9c793ce2938b7a8d4451

SHA256
f9745c48d0b4c918d466da4acdb3f786ef5cda4c69ac0b6009d76cff67e6325d

SHA512
4b720f5f9b103686cc7a22978c105d5d9ba53322e1455a8fc40ea8ad2706091e64c967d6ea192a114ae9c8cc585ce2a35d99992439172533d30982a440db663f

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\5OM78W03\iJWZBXyIfDnIV5PNhY1KTN7Z-Yh-NYiFWUU1[1].woff2

Filesize
24KB

MD5
02ac191f58314f4c044700cc49f544c0

SHA1
ac8fc920e3b31ab2e4f58dbb4fbc7329efdbc936

SHA256
8189eb6330e9f0b62e4fe2be8bbad8129ebf1db97e390c2386e0b5a2880aa403

SHA512
1ef381ce838f582232528c549b1020db465f5481326b49bec064226993ec84f685f0c37bb9266940f48e86d380e46a565b84f548efe3321202dd361264c36c7c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\FWA0B2NI\nr-spa-1215.min[1].js

Filesize
46KB

MD5
7e1862f7a390ed9fc02c299216395547

SHA1
9be3f87c9849cbdd8dababccebe77fe5c6b30702

SHA256
dd2d8d288526b88b0eae53168e31b4092acf39ed38d40ffcbc6d0ab2f7a4aa66

SHA512
45eba74a86e4cb778c406a5cc2ca56283d156d06b59cfd9aca7221a9dc4bd1cfebb740d6955ca054a88affacf4318f709ed39b0cc4a27978fb780e18d34dc0c0

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\JM0J5YI3\main.40b0b1c7.min[1].css

Filesize
251KB

MD5
e951cc232c3909ad5d1f4af04913b92d

SHA1
679cf49ef4066cadb526df563f6bf27fb44c806a

SHA256
ababd895aab5fe98332ab44c07f64069be5a6f3ab1dbb2ca3de1d00442a81814

SHA512
55613ebe862804fe7c23b46fec15490eb3b2690f68863fd10706f47f749fdb5c3fdbfd376a5651b7c5cb4abf008be5118934bb891d1296aaee5ab0f660255a6c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\JM0J5YI3\main.71ed00e9b76d3cf28305.min[1].js

Filesize
1.7MB

MD5
5626ef60f39959e22198fa279db608f5

SHA1
ed9e332e1a950eb64f58f988712aa4932ab89da0

SHA256
338be5eca652933d4a2068e482045204fd588a755808dcb4969b9eaf4607e288

SHA512
2f732a224dc7770339defa5ec7a38e3567abd1066dfc81ae25ca1058ab0d99be9b3300109d45431e71d0bfa10dd2243d5911dccb74ea136b12c8edda40376015

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\JM0J5YI3\vendors.b9091db711dccf4fe931.min[1].js

Filesize
1.9MB

MD5
b450d61c5acb2f64afa3a5474e116a36

SHA1
5858d973e5317193507d916b62004dbc2a17da8b

SHA256
4b18e23b056f4da7fe8d6576c974ddca46e487a6a276cb7020709b062f64b246

SHA512
615ad184340d1c30265ad01b29c31e509d65e3b3dc540b80fbab9c3978fb0dfa55c1d4201be06150fc9f94b5d167090ac29314d104b83a81db8fb183d50ec12e

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\VBZVDBB5\css[1].css

Filesize
573B

MD5
fc3912b7ff97a9ecad4bb8593dc32886

SHA1
868896649ce92704a65bab3dacfc8772272d3e4a

SHA256
6474e8ce25b0b0c89f83f2319dbecd72540ebd2e5f6825704f1947194009b93b

SHA512
120840f5d5cecf70861962972d43ced670ee4109826ba2e1f183de35905089d55658edc68c138324e283821bab4657b9bf74bfc79e0025168afdc0e5b6faf035

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\VBZVDBB5\forms2.min[1].js

Filesize
208KB

MD5
fd2cf85265fa9b5b78fc30296eb561f5

SHA1
ca8da733564f2bcdff71cb79b42fb1b6812e18d9

SHA256
e6ff9c0c443a9050137759816c352d43e96a673bb4023c2ba231cdbed6fe6f52

SHA512
d2ba0d49be4d4568a5f8d2d6ca75569667d4b2dc502ca03420e301cff2e0353340231d4ced4cf826b68bcaedfce3e63e0db39f63dd95396269bb6db241e8c57c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\VBZVDBB5\iJWZBXyIfDnIV5PNhY1KTN7Z-Yh-4I-FWUU1[1].woff2

Filesize
25KB

MD5
d6daf5bce3027651dcd1f92e59e00e95

SHA1
264d9616aedef849393c99dd102fda0c0387632d

SHA256
46ed19e2d021296a35c1632b877c5fff1aa3c3eaec27d49d892e94545b792b43

SHA512
086a96127dd0bbfd703797f94987de5ba81d34e56df10a0ef59107fb2e949d66e9376db11402bca159aedfa87cadf2fc60539e936adb7a86f2de5ae455e32f68

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\VBZVDBB5\iJWZBXyIfDnIV5PNhY1KTN7Z-Yh-B4iFWUU1[1].woff2

Filesize
24KB

MD5
00350b741e6792d88386a79d5ae11e0e

SHA1
88d4eda6b25d2e30b5f0cc338f7a50e62442e19d

SHA256
fbf0d9704506b1ad0def13dc96bf24602d807afe597a754ae59fe1d2c0efcec4

SHA512
f10218ead6b94b88f12b8331b36c57f652f0e31f4dadc939127a0dcfbfe30aff149ea3a48e562a68a28e1f6942cd3fdc03f7d45930a60f65c1021c3a62ac38e4

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\VBZVDBB5\payment[1].htm

Filesize
33KB

MD5
fd1dfaf15d66f51bc8819d121488e963

SHA1
013a22cfd9ed3b611589a16b7c5f1f1bb86bdcf3

SHA256
92cf82e03c37ce6994c6cc7de7f92af17efb275289bdd2fa5c0e028633cd393a

SHA512
bc5c4048bbc544d634e2ccde0d2d2fcd48c44a1c5daaf1a15f440a61b0da14c182946895919fcb8085acea83629124df8d18a885368629c82924bdb14018c88b

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\XC04VGOB\www.flywire[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\XC04VGOB\www.flywire[1].xml

Filesize
4KB

MD5
9f98eda655fab11dc08a7db15679a9b0

SHA1
558bbb9e1c62143300315177556bdf50ac91d929

SHA256
1b55a355a38dff04878016aee90b920706ea3cd773424aa5f634eb8330abe08b

SHA512
b7576c9ccac5bd770f49b032319de40255c3d701cf7ba9afd3821c8aba294a4e03760c165ba8d32c1c72207bfb91907c0ea580784d53f6c026b236958c261475

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\XC04VGOB\www.flywire[1].xml

Filesize
7KB

MD5
6820670b87728be6f52b6322d9549cf2

SHA1
ecfbd4ccb1f0a2df806eb02dd22871c676e55e47

SHA256
537bba46da8fb19d5774b0a2318f1fc2b0edaa298baf9ebf30f4bad949f0f981

SHA512
ba81bb783ef33cecab2db9346be4dcdb9daad0e691bd91ada1d33fb8ef814fbedc69e4280204f8da96e1b3c5427bae7e012e214a0f149f9ce93aeabb32833b37

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!002\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
4KB

MD5
1bfe591a4fe3d91b03cdf26eaacd8f89

SHA1
719c37c320f518ac168c86723724891950911cea

SHA256
9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8

SHA512
02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\RL13HK6H\favicon[1].ico

Filesize
14KB

MD5
9037387eb7cc6a5af4507161e418f795

SHA1
067bece2411fb4dc4c8574130ef16f0137529f4c

SHA256
4bacdd302bf60290262423b42196779018bbd793c50435732e7e756fc9ce3725

SHA512
7370d5a3bc936125ac514783853d1b419eaa0423493efeb1c2de79e67c098966a6b63df2932e8b8411433f863b20847d8b5705651e967bea5904df6338eb4b2d

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\RL13HK6H\favicon[4].ico

Filesize
14KB

MD5
231c2ff9cb5017bc6665e6e194256cf3

SHA1
75c44fd8f48c09abbfea5984e52cf58a773eea33

SHA256
a54a616e124f0724eb7dfaccdf96f3c0877f66c5c4043ffafae213bf284ec541

SHA512
fb3bb6e76f91721647fbf06a68b9947f30fdddb1e24a9e86d42b16b738c9355db13ae1eb3f82bd604cc6fcaa8282fd10e0fddff10c77e22eb6831db5926aaa22

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\YKEG9F5N\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\ImageStore\hmxo271\imagestore.dat

Filesize
38KB

MD5
d5c2e4f1843e9e9767ec5c51763cd5be

SHA1
f6424fb7a51f57c524505a3e2bf258318c943cad

SHA256
391d4a67371ab211e1f916f16e42c8f4588f0e3a3343c05989fd84f5a449d40d

SHA512
a7e8ed3b72054e84117167931547d4546ab5a11c00efb70a00dc598ee2ed00604f51af793e70859b8e911104e1bf8b414e1e33bde1996b9ed482f11c3c827238

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\5OM78W03\iJWZBXyIfDnIV5PNhY1KTN7Z-Yh-NYiFWUU1[1].woff2

Filesize
24KB

MD5
02ac191f58314f4c044700cc49f544c0

SHA1
ac8fc920e3b31ab2e4f58dbb4fbc7329efdbc936

SHA256
8189eb6330e9f0b62e4fe2be8bbad8129ebf1db97e390c2386e0b5a2880aa403

SHA512
1ef381ce838f582232528c549b1020db465f5481326b49bec064226993ec84f685f0c37bb9266940f48e86d380e46a565b84f548efe3321202dd361264c36c7c

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\FWA0B2NI\nr-spa-1215.min[1].js

Filesize
46KB

MD5
7e1862f7a390ed9fc02c299216395547

SHA1
9be3f87c9849cbdd8dababccebe77fe5c6b30702

SHA256
dd2d8d288526b88b0eae53168e31b4092acf39ed38d40ffcbc6d0ab2f7a4aa66

SHA512
45eba74a86e4cb778c406a5cc2ca56283d156d06b59cfd9aca7221a9dc4bd1cfebb740d6955ca054a88affacf4318f709ed39b0cc4a27978fb780e18d34dc0c0

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\JM0J5YI3\main.40b0b1c7.min[1].css

Filesize
251KB

MD5
e951cc232c3909ad5d1f4af04913b92d

SHA1
679cf49ef4066cadb526df563f6bf27fb44c806a

SHA256
ababd895aab5fe98332ab44c07f64069be5a6f3ab1dbb2ca3de1d00442a81814

SHA512
55613ebe862804fe7c23b46fec15490eb3b2690f68863fd10706f47f749fdb5c3fdbfd376a5651b7c5cb4abf008be5118934bb891d1296aaee5ab0f660255a6c

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\JM0J5YI3\main.71ed00e9b76d3cf28305.min[1].js

Filesize
1.7MB

MD5
5626ef60f39959e22198fa279db608f5

SHA1
ed9e332e1a950eb64f58f988712aa4932ab89da0

SHA256
338be5eca652933d4a2068e482045204fd588a755808dcb4969b9eaf4607e288

SHA512
2f732a224dc7770339defa5ec7a38e3567abd1066dfc81ae25ca1058ab0d99be9b3300109d45431e71d0bfa10dd2243d5911dccb74ea136b12c8edda40376015

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\JM0J5YI3\vendors.b9091db711dccf4fe931.min[1].js

Filesize
1.9MB

MD5
b450d61c5acb2f64afa3a5474e116a36

SHA1
5858d973e5317193507d916b62004dbc2a17da8b

SHA256
4b18e23b056f4da7fe8d6576c974ddca46e487a6a276cb7020709b062f64b246

SHA512
615ad184340d1c30265ad01b29c31e509d65e3b3dc540b80fbab9c3978fb0dfa55c1d4201be06150fc9f94b5d167090ac29314d104b83a81db8fb183d50ec12e

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\VBZVDBB5\css[1].css

Filesize
573B

MD5
fc3912b7ff97a9ecad4bb8593dc32886

SHA1
868896649ce92704a65bab3dacfc8772272d3e4a

SHA256
6474e8ce25b0b0c89f83f2319dbecd72540ebd2e5f6825704f1947194009b93b

SHA512
120840f5d5cecf70861962972d43ced670ee4109826ba2e1f183de35905089d55658edc68c138324e283821bab4657b9bf74bfc79e0025168afdc0e5b6faf035

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\VBZVDBB5\iJWZBXyIfDnIV5PNhY1KTN7Z-Yh-4I-FWUU1[1].woff2

Filesize
25KB

MD5
d6daf5bce3027651dcd1f92e59e00e95

SHA1
264d9616aedef849393c99dd102fda0c0387632d

SHA256
46ed19e2d021296a35c1632b877c5fff1aa3c3eaec27d49d892e94545b792b43

SHA512
086a96127dd0bbfd703797f94987de5ba81d34e56df10a0ef59107fb2e949d66e9376db11402bca159aedfa87cadf2fc60539e936adb7a86f2de5ae455e32f68

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\VBZVDBB5\iJWZBXyIfDnIV5PNhY1KTN7Z-Yh-B4iFWUU1[1].woff2

Filesize
24KB

MD5
00350b741e6792d88386a79d5ae11e0e

SHA1
88d4eda6b25d2e30b5f0cc338f7a50e62442e19d

SHA256
fbf0d9704506b1ad0def13dc96bf24602d807afe597a754ae59fe1d2c0efcec4

SHA512
f10218ead6b94b88f12b8331b36c57f652f0e31f4dadc939127a0dcfbfe30aff149ea3a48e562a68a28e1f6942cd3fdc03f7d45930a60f65c1021c3a62ac38e4

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\BJ0K3S1I\payment.flywire[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
b74e62d4ae5396fb19a83960e0040f9f

SHA1
c66f4f295f975b8fa86fa1abb023831cc6c936d9

SHA256
9ce1c60ea150d931cc5743d72ed206cb125a83f58edd39956ff829a0297bebc8

SHA512
1e90b31f2d1d740f585d50d8523260302657d3b6123726022bf259378e8a85fc257c125e6e295147dda0e745eee4bd83ff180ee10063f87cb89f9c168a43c8a5

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

Filesize
1KB

MD5
7f9785c64c59d9e29126a337aafdbabe

SHA1
9a00b8d563619497851f7976fc76a3af0cc8c05b

SHA256
ebccdacaf89db3e2672680214f08bb09e53b0b370f4c60292cf3fc9292c51bda

SHA512
7324b497b749665989385aaba8f0d14f1d0d488b2bf8d21196cdc1d41c610b2c1f080046691a2b0e1d499360a52ffa66ed0283e65914cd4c798929440856b61c

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_89709BA6A8E04CB298EC71539929CC6D

Filesize
1KB

MD5
2826d8551981374860c214b8c3c1f8c9

SHA1
e49d5bc4061b6e49a92f781207605bf5992354ea

SHA256
c02e7ca9b94133d8718b369b3136c5f71a3e9d46e5895f7f96975259a0711317

SHA512
0748629e4dc8d0fc3386820ea86a687b0b69c8de2f364dd445cc8e38d3b4f5290a87d6a9d75d09a95584107c794aaf5e9ce503b58f8d9ca1f83fe97b68781be8

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
ac89a852c2aaa3d389b2d2dd312ad367

SHA1
8f421dd6493c61dbda6b839e2debb7b50a20c930

SHA256
0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45

SHA512
c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

Filesize
471B

MD5
8fb58e209eb7b3bfd4db5f4a6ebd3979

SHA1
aee417cf562655213940057d24c49f2f4424e957

SHA256
69de194d910f6422f1702eff05e3883835dc24835d0231773b7a87c3e7d87454

SHA512
c95181b31fa82e1df2f227f87867b3553e5dafb73e6e1572e9ffd9ad8e4ff4246a605227f262aa3c1a04e04e35d89daa4e482ff881e9c7ff7ca8e6018bc7e9b2

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_17A1BB9C6401DC9652040571BD192211

Filesize
472B

MD5
0d46061a64aeda010b5428095183221e

SHA1
26c92f1784a8fa6e26cbf08d89e95ae0ef64812a

SHA256
b7015bc0ed1ddcc42d3aacc0d18e344e28e540db1419db40b87f00ba22dc0c07

SHA512
82bc91d01637e4ae90b790b0a210ab4be9f9f2c455da630def344312e35bfd6e0295809b1de729c164591560c3f92c5ba3e75c55f1f966253c77f613dcac0c75

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_57DB0353F73BFEAADC2A8A5ECA70ACE8

Filesize
471B

MD5
5dac04bb185d02ca5f10a60e82561875

SHA1
b8a07b597acce4d6dd5b0bfd05b1481c1e857708

SHA256
ea7b8be0e8d0c3d3a68cc7a96237576f919c2a148dddc0afef8aa11c4a62ea66

SHA512
748781ac9ef6f60f3461a51f55cb14f265e473f187e02b04285741a4d42ba6fb29e9e50dcc0acf9d18afcd81317057fbbd244912d442ce5b4428300f30dae786

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
1568a661f0dcd8581ce96d0513a6ada3

SHA1
5cab7f09b1075f99ef4914ab1ea3fbbbf6bad31f

SHA256
5dc66f398277c4e19b287181eacd2bbe51479f47599e1d976460e82df050f1d5

SHA512
4041c9fae7dbaa61e757eadc2c64b86936456480ea7e37da80ae527a5211bbc073bec22fee22064956e80c79f9880aef94fa30d05e67f92726fb4fb46f07b4bd

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

Filesize
408B

MD5
920d95807ca12d2ad010cd1bff90d9dc

SHA1
076eabae8778f41165546f2b5eca32cb0ed343ff

SHA256
a8bf7e1b7579d29e4c9fbecaa774b113c50036a7f29bb09ad1c64bce0da604bb

SHA512
14005a5c68795a62b83b2fb0973118ab09e40340bbc3c8d04452c40293986862e42e5f21a0badbe134b82cf0f7f59082986e11e4ad9c3579e5224c1cb82049e6

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_89709BA6A8E04CB298EC71539929CC6D

Filesize
510B

MD5
4e057d5c2ddeb893e5cff8be34f10dc5

SHA1
712dbbe638c33d35a84f6fa8a02bbcea388f0a15

SHA256
f13ca870695298ec3e0f33e528f796545123ffb234fe31c5ab6d5021a6ffddf7

SHA512
293437da8144b6dc50ad6c7fa0e3705f06e2e76ae746eac3a6ec7802584a78f4be745e6aa1c75a93ae0a8e9c2f279489b27e0d5e86598ded49c73fb7367ee636

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
60be2038dbaa473004eca20999415469

SHA1
f02fc129fb3cd9665965dd44d7f06d286d931e39

SHA256
f34acff5bf6be2c218002351e7b6a9fcdc9f288a7c61636ae641e92aa967df62

SHA512
27f65efe89876c817144d65979af824d7f97d5a233689433ad5245b0b5ed172ccbe01a6dc3341f16e37cd342eebe07ce159cb781470a88b12fd70f32063960e6

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

Filesize
412B

MD5
b69142bd2b88ef0ad4d392321e2741d5

SHA1
70faec0d7e01c43a815aed2e499caba0cec801b3

SHA256
dfac4bf3a2878a7d738879d1025b1204612f482546fae8b74e9927583f532023

SHA512
993f7cfd973b2a730fbf369cb78703e36e048eefcd8cd23adb2390bff2b5b37c91d3fb8fb5263f2b2c86af1a232890fb64a39400740392fa0ce642fa9ecb912a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_17A1BB9C6401DC9652040571BD192211

Filesize
402B

MD5
f78f2b3febe8527f069d85d1d3483831

SHA1
a3acc1d08549153c303328f3dda3758b6d0359ea

SHA256
1c16fb27823d684de03a1b2e7fd9121065776b0849fefbd3587a5769d5f3d82f

SHA512
303751e8508051ed7d6066007bd896fa194767c58b12b4bfdd07f2d7e346efccfd97d4152f116fba881ba2f3d3a435d704e73f2b858e9857bb968d5ebab81e20

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_57DB0353F73BFEAADC2A8A5ECA70ACE8

Filesize
410B

MD5
b41a4e7e895767aa92bc52d15fd71583

SHA1
02cb8a6f2adb88a197cf004600def06366e2d6c8

SHA256
deeb501a2e0ea999e5e99532c398a0d160c0f8d1e56a205f0ae532faebca7472

SHA512
2ef4ee85cf719df0a6571f1a64c0274ab032f71f588edf357e32398577ee0f1ceb61b92c584c7dd7dbd8dc299541e6bd273b96132af111b22637b67be2ec3cbe

Download Submit
memory/1156-748-0x000001DE1C160000-0x000001DE1C162000-memory.dmp

Filesize
8KB

Download
memory/1156-779-0x000001DE1A5A0000-0x000001DE1A5A2000-memory.dmp

Filesize
8KB

Download
memory/1156-901-0x000001DE09020000-0x000001DE09030000-memory.dmp

Filesize
64KB

Download
memory/1156-900-0x000001DE09020000-0x000001DE09030000-memory.dmp

Filesize
64KB

Download
memory/1156-570-0x000001DE1A5C0000-0x000001DE1A5E0000-memory.dmp

Filesize
128KB

Download
memory/1156-887-0x000001DE23900000-0x000001DE23A00000-memory.dmp

Filesize
1024KB

Download
memory/1156-870-0x000001DE225E0000-0x000001DE226E0000-memory.dmp

Filesize
1024KB

Download
memory/1156-906-0x000001DE09020000-0x000001DE09030000-memory.dmp

Filesize
64KB

Download
memory/1156-865-0x000001DE1E0C0000-0x000001DE1E0E0000-memory.dmp

Filesize
128KB

Download
memory/1156-904-0x000001DE09020000-0x000001DE09030000-memory.dmp

Filesize
64KB

Download
memory/1156-664-0x000001DE1E620000-0x000001DE1E720000-memory.dmp

Filesize
1024KB

Download
memory/1156-751-0x000001DE1C170000-0x000001DE1C172000-memory.dmp

Filesize
8KB

Download
memory/1156-754-0x000001DE1C1E0000-0x000001DE1C1E2000-memory.dmp

Filesize
8KB

Download
memory/1156-757-0x000001DE1C300000-0x000001DE1C302000-memory.dmp

Filesize
8KB

Download
memory/1156-761-0x000001DE1C480000-0x000001DE1C482000-memory.dmp

Filesize
8KB

Download
memory/1156-765-0x000001DE1C730000-0x000001DE1C732000-memory.dmp

Filesize
8KB

Download
memory/1156-769-0x000001DE1BC00000-0x000001DE1BD00000-memory.dmp

Filesize
1024KB

Download
memory/1156-745-0x000001DE1C140000-0x000001DE1C142000-memory.dmp

Filesize
8KB

Download
memory/1156-873-0x000001DE225E0000-0x000001DE226E0000-memory.dmp

Filesize
1024KB

Download
memory/1156-737-0x000001DE1A600000-0x000001DE1A602000-memory.dmp

Filesize
8KB

Download
memory/2076-95-0x0000022011EB0000-0x0000022011EB2000-memory.dmp

Filesize
8KB

Download
memory/2076-93-0x0000022011DF0000-0x0000022011DF2000-memory.dmp

Filesize
8KB

Download
memory/2076-91-0x0000022011DC0000-0x0000022011DC2000-memory.dmp

Filesize
8KB

Download
memory/2076-97-0x0000022011ED0000-0x0000022011ED2000-memory.dmp

Filesize
8KB

Download
memory/3552-400-0x0000022F2D490000-0x0000022F2D4B0000-memory.dmp

Filesize
128KB

Download
memory/3972-129-0x000002478A520000-0x000002478A521000-memory.dmp

Filesize
4KB

Download
memory/3972-130-0x000002478A530000-0x000002478A531000-memory.dmp

Filesize
4KB

Download
memory/3972-0-0x0000024783E20000-0x0000024783E30000-memory.dmp

Filesize
64KB

Download
memory/3972-35-0x0000024783FF0000-0x0000024783FF2000-memory.dmp

Filesize
8KB

Download
memory/3972-16-0x0000024784400000-0x0000024784410000-memory.dmp

Filesize
64KB

Download