kinsing | hxxps://www[.]syntax[.]eco/games

Resubmissions

25-01-2024 15:59

240125-te8hesabf2 10

25-01-2024 15:49

240125-s9jxwaahgn 10

Analysis

max time kernel
171s
max time network
172s
platform
windows10-1703_x64
resource
win10-20231215-en
resource tags

arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system
submitted
25-01-2024 15:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.syntax.eco/games

Score

10^/10

kinsing loader

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing
Downloads MZ/PE file

Drops file in Windows directory 7 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

browser_broker.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "268435456"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = d86f3b50a64fda01	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage\ProcessingFlag = 004d3b50a64fda01	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$Telligent	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000021097fc79ccb0e46b7acd080b74ee93e00000000020000000000106600000001000020000000b0fbb53d950287b8f8311f4496a3f4faf27a69b16a11088a6f5764e6b80453d0000000000e80000000020000200000006dca3645363173f0fbfeb011d97ad231d2655fd76f728c197d6fd7ce2f1439b4b0000000b94292b7c9e3374556d942cd3912c14c63e00d6e86cd9cf7b7207dd5b4de73d3e263b417455c9ff7199d3de05f40db0fcb0b466f36116bfc5ccdaa1a44dbae02122bdb262d61d904e5beaa34b697ad8d1a49c6aa15c20456fd18a58b4aa0ccf604ebe0107ed50e2facf6307ce0bda73c6a9e544ed4486fc11b03c44ea530a1de9f3bc99d3dabc067e22acfdbae290541b4b878fde6236801e5fdc4760b962dde4941c45593de8645f91e13cd047d2aa340000000eb1f4e1f2f19243a9fdb3f01af6e9a4b13aec1d2cae8fa3b739bebe54eb3348172ed1a653c988c235cf478969c59cfdd78a794cbe97ddb06c183065101ff1ab8	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 9c0fa568a64fda01	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 02fa633ca64fda01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\DisallowDefaultBrowserPrompt = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\NextPromptBuild = "15063"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$Discuz!	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$blogger	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = d6895242a64fda01	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000021097fc79ccb0e46b7acd080b74ee93e000000000200000000001066000000010000200000007d8d3d7e1d3af6ab9b8725ab5802e97a5234948ce916711166c0546e3b4e6185000000000e800000000200002000000041583faab445082890fd92c866f715b6f24a07c5812cc494dcea32f43dfbe34120000000ef57296cf3de79cf05074c14361911e2faafff0613e2abd10bdc1e44a41af3fb40000000e85e503c50370291ec266df7bfc7bad9a904e2b27b07e336a76af40b971269d7def202c111358a1d0d3b205cc14ff1c385dbc30a3faf126e45c994387a27632d	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IntelliForms\FormData\096420CE1C9A31839715B788EF20650AE3D0 = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000021097fc79ccb0e46b7acd080b74ee93e00000000020000000000106600000001000020000000db40d889dd274c4af670de166f1075653024ecaaec36be32a6d6a6bc24d2be43000000000e800000000200002000000006b3c46f4742a9b8b7e3be1592a72c74b88db0eea6c7f2b0af27282176fac70950000000cbfe6fe219db0b658c2cc56bd4ea5fdadfa040bf7de4ab924d3328c4ce2bed8baa7d027f5133aac4bcafa8054031fb46251347adef8e5e92bd3824f9834621c2e31ec8676e52692cb82efd998a2d697740000000a456177efb3e9c84a338cef7e9f859402db9221cce5c3c70e372d9640a8b11ef1899ec4bf406be2782fdba38810a51a4bf4ca3afd2683ee7ded2b708caea9f86	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IntelliForms\FormData\096420CE1C9A31839715B788EF20650AE3D0 = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000021097fc79ccb0e46b7acd080b74ee93e00000000020000000000106600000001000020000000df994efd713af07829424aa701023c034fc670ba1130da2e3baf497c24ae26c0000000000e80000000020000200000003b4c503aa3c9be62d3571ab4e0fc17274135efd7207d6c941234ebdba9ca1728800000003775c42901f27c516e2c76f81bf73d7c708db049b299d603ca3d09021bb151b0b8128306adb9b53c2ad07510e7c71653571233eb5fc5699daccd826543f63676ac0e6d99e2650f2300051a893a23ca56695b6bf0ac65f9b1bf6a17010d35fd4c3ccedd74229608202913bcd638af482e75f18cdb1df97c7011fc6a15e6ce313a40000000f513b30b4adf4baec9085a8ad7fe1d2cfac228e8a8ed914d11aee095db9a044cb8243ffa2cc37f082b259d5619bc291ec21cf439eb435bea34bbd55af378b557	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$vBulletin 3	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History	MicrosoftEdgeCP.exe

Suspicious behavior: MapViewOfSection 8 IoCs

Processes:

MicrosoftEdgeCP.exe

pid	process
4556	MicrosoftEdgeCP.exe
4556	MicrosoftEdgeCP.exe
4556	MicrosoftEdgeCP.exe
4556	MicrosoftEdgeCP.exe
4556	MicrosoftEdgeCP.exe
4556	MicrosoftEdgeCP.exe
4556	MicrosoftEdgeCP.exe
4556	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

MicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	pid	process
Token: SeDebugPrivilege	4616	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4616	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4616	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4616	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2132	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2132	MicrosoftEdgeCP.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

pid process

344 MicrosoftEdge.exe
4556 MicrosoftEdgeCP.exe
4616 MicrosoftEdgeCP.exe
4556 MicrosoftEdgeCP.exe

pid	process
344	MicrosoftEdge.exe
4556	MicrosoftEdgeCP.exe
4616	MicrosoftEdgeCP.exe
4556	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

MicrosoftEdgeCP.exe

description	pid	process	target process
PID 4556 wrote to memory of 3184	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 3184	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 3184	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 3184	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 3184	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 3184	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 3184	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 3184	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 3184	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 3184	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 3184	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 3184	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 3184	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 3184	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 3184	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 3184	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 3184	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 3184	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 3184	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 3184	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 3184	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 3184	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 3184	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 3184	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 3184	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 3184	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 4172	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 4172	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 4172	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 4172	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 4172	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 4172	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 4172	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 4172	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 4172	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 4172	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 4172	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 4172	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 4172	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 4172	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 4172	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 4172	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 4172	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 4172	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 4172	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 4172	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 4172	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 4172	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 4172	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 4172	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 4172	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 4172	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 4172	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 4172	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 4172	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 4172	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 4172	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 4172	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 4172	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 4172	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 4172	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 4172	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 4172	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4556 wrote to memory of 4172	4556	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe

C:\Windows\system32\LaunchWinApp.exe
"C:\Windows\system32\LaunchWinApp.exe" "https://www.syntax.eco/games"
1⤵
PID:3192

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:344

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:2636

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4556

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4616

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:3184

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2132

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4172

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4288

C:\Windows\System32\DataExchangeHost.exe
C:\Windows\System32\DataExchangeHost.exe -Embedding
1⤵
PID:1236

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4080

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:5100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Filesize
4KB

MD5
1bfe591a4fe3d91b03cdf26eaacd8f89

SHA1
719c37c320f518ac168c86723724891950911cea

SHA256
9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8

SHA512
02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\EGHSWRQT\edgecompatviewlist[1].xml
Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\I5YF8KIM\global[1].css
Filesize
7KB

MD5
fb8345bcc63bd63dacb2399addd3a6cb

SHA1
fca5e06810b95c668359f9ec9c29c466046a74ba

SHA256
3196a166b615fe866a87c0ddab69e2279071b88f089611bfeae1f0e33b4b82c2

SHA512
1155bf8d7655ada81edacd92cd05b0578167a07b53f4eb0eb77bdcc97f30160fed9dc494a1d8872233c15567d4a2f344779c154245371d453a028971d0193b67

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\I5YF8KIM\js[1].js
Filesize
277KB

MD5
8fd5972abd09dcc011e81306ff0ae1ac

SHA1
7b2a7443e91fdd62c3a98a173df74950549dabe4

SHA256
3af5b28b545cb3ad5c40487bb3ef920a445610b3949f4e05507c7cd6a831c338

SHA512
124ee9822974dfb7043f4eb848568eaef9e7d6b27adf44614fa591023b0eae7d7e1c7a3867a4bc4cd062e7acfd94e9a2eb9aca9ff1d73501847e32f7171d8c7e

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\JBYZPOVU\bootstrap-icons[1].css
Filesize
91KB

MD5
8f4b242830ec54686815617e7b5a5b1b

SHA1
a7838d8a20dbda0ee9e4c1cb7f1f832ce9af1c11

SHA256
d8824f7067cdfea38afec7e9ffaf072125266824206d69ef1f112d72153a505e

SHA512
d326210b288c07ee973a2b38aaf580e3690f90a6f9e3eb8c68e85bb2d6ba9be690edc64e9b98731113eb4649249e5a44768c550b062e8bec8cd2345ace90c5b8

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\QSYH8ICW\bootstrap.bundle.min[1].js
Filesize
78KB

MD5
78c4cd0c84838bea16844c9f9ef24b83

SHA1
8cd7971318371ab3d16379df6cfb254a5c649fca

SHA256
ea8fe021a4ace4f6786fecc418f70b658fc2dc02d136e8fe5c6ab6b62a46d5d0

SHA512
bc80244dddc0af2f6bc1fd25adbf64222a722246af2a96069f2a29057b3a4a22df352cc0bc236fbd0bcac015795e56a0e0ef286696795399f86c7a04ac64318f

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\QSYH8ICW\bootstrap.min[1].css
Filesize
227KB

MD5
d603cfa239a34ac65af566681e7aa3e7

SHA1
4af3d7e15a6a380c6cbabba42e9adf330b49d58f

SHA256
16ee7f3d53462650bbd32e263c48c0ea759574fcf620c681ad719008912c461a

SHA512
8868c69b0226d541cd692bb088d15f077f87a734ff60b24c8983cace54045694fa1568b9adfa5bcab06e4cfb1e49c382581911b6cad121bad3cc9a50d3621a2c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\7921PKCP\suggestions[1].en-US
Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\9NQ02WJC\favicon[1].png
Filesize
7KB

MD5
9e3fe8db4c9f34d785a3064c7123a480

SHA1
0f77f9aa982c19665c642fa9b56b9b20c44983b6

SHA256
4d755ac02a070a1b4bb1b6f1c88ab493440109a8ac1e314aaced92f94cdc98e9

SHA512
20d8b416bd34f3d80a77305c6fcd597e9c2d92ab1db3f46ec5ac84f5cc6fb55dfcdccd03ffdc5d5de146d0add6d19064662ac3c83a852f3be8b8f650998828d1

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\9NQ02WJC\syntax[1].ico
Filesize
114KB

MD5
2f498f93d25b71f090256049bbab8de3

SHA1
098a627ead25252aa360e605fdb08f94322b0db1

SHA256
42a5d2d9fe4de34038046225e79188f93908435c7f2e6cc3beda4439e0615fb8

SHA512
9a878aa20e6951d90eff49324b9945312320ec0ec32c708fe977c11fb2b54f19e4327e35fde6afef4492f3cdcd07c7def64608adea8bfc816050d575b459f889

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\ImageStore\udtsyv4\imagestore.dat
Filesize
123KB

MD5
c5f7fdf21c0cfe1485d8bd5813dd192e

SHA1
99e1c7e3eb5ba5706ad94e71c0c1f97e2d10df24

SHA256
f0fbb70b3c4798ab1f3d158a902e1a000e940b6a79144de575ea626f0bd6d5c8

SHA512
62a846cb423276917cc5b842a078684a9a71a0b8b445d57da0bad6d10db86882a44b3be1f85026afab6bea08dc8c667939ece9ab5b002e9f4909cf459e52fec3

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DF3F129497324EBD7A.TMP
Filesize
20KB

MD5
0a18b6ab1a23aba84c590320bd42771a

SHA1
783a4c27c38ae7ce59159f4de9eced2b1717c636

SHA256
f14d402f59a99f13bd5a9b3c7fee791e8fb307ce10051d54f5ab90acf02db678

SHA512
71be96b4c14b0d3d8b0a5eac4fe2da10faed13707cacb7b4670b47621ed36123b86f43114235e4fa5e1dab03c43d7e5895716bc59c2807017a33b8532bc59c4c

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\JBYZPOVU\api[1].js
Filesize
37KB

MD5
382de2d5802b5bd3d87cf2fb3071121d

SHA1
d0299a88eb32dbc533d61b024ff6e35956113e29

SHA256
18cbe0edc0b01c71a6c3ffe704550a8bb1cfe7e02839b7dbdc9c44288bf8b59c

SHA512
8e40f9af6117018e7a6ad62ec2988c82eef9f4dd29915a40b9741da8663f60d17594a60633ad9cdf8c5b153d025de4f3cbf39bf81a915af243b385cd9eb7e387

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\QSYH8ICW\LoginImage[1].png
Filesize
399KB

MD5
95d787526e50fc71cbc01eee287162eb

SHA1
c5cf78a249ad309e4cc2bc34c0438b3849f857ef

SHA256
215e81d8fd3c64f72feed12ed4b3eea30256b19785543c7085ba087164d8e550

SHA512
ec3a49548c813cb6fd49fb7b240748a3046852da074299d7fb8d34b8c97e480acd324d7514daffafaf19398df53d1de5b5b712f19222b2f4d54e563324e5bc65

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\QSYH8ICW\MicrosoftEdgeSetup[1].exe
Filesize
48KB

MD5
3d5c1514e0f2c6881b5019daedf52aa8

SHA1
28617577233b9d7a35930c7e38704206b9578c3c

SHA256
c256f9dd57cf6b1e23adfb24c25a5d1e9280d310b230a91b41f7c3a2000677dd

SHA512
0d28c925cc83bbdc46e091981507e58dfa240e085cd8dbf474ad78089b393b49622712a03ab2b910c13ff636ea9d18f4ff4c490a507247382c0971a268dbe5fc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\RAV0OH8N\SignupImage[1].png
Filesize
700KB

MD5
b7a30953f1ade8c39801fe5a49a2321a

SHA1
54f1e775b24e6bc3db3b78561faf225ee4e046a2

SHA256
bec2f84f9e5c3e918c281660faa5e142e754d548aa33e098fd822740db5dc0e6

SHA512
c0ea6e79c395e483435a7f88bed2040ce760aa5d7fd5084ced3693bb79c2de79f9ee36b72c61d00da99990332e0a03789a415022ffb3ba7c6592233ccdc95174

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\RAV0OH8N\login[1].css
Filesize
1KB

MD5
211eeb92d3eb03e8c0d8f9be6bc47470

SHA1
173d48954c7225de1bd5fe5814563be822566558

SHA256
ac944664c46c032508caef68671b65bfa239c41d199c18968a0f4fb702391914

SHA512
8db7dcc446fb89b40f381c46a0d416dbb0bf71679bf369f61b9a8dd0d284e0dd9495d9f4249f7ebe20b1a93746c1498c8602fa3fbf29cb61e5b343c50fa6e816

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\RAV0OH8N\signup[1].css
Filesize
1KB

MD5
997a533aeb671c3306e7c7f4ac45f9bb

SHA1
38c09368e82a0bf684450f31c32ee5487889fc70

SHA256
dbf2a71ba7574bf2a66c5631b916132eb555827f7e92a9c09870c1d5db0383e1

SHA512
6340419308850489d8290e27c7f321785de0a0a995e955a658b78ce311eb048be7729cd5c9afc0c8c3a100e8947d5944cf01e366bdd137265a47fa42d04fe3a5

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Filesize
717B

MD5
60fe01df86be2e5331b0cdbe86165686

SHA1
2a79f9713c3f192862ff80508062e64e8e0b29bd

SHA256
c08ccbc876cd5a7cdfa9670f9637da57f6a1282198a9bc71fc7d7247a6e5b7a8

SHA512
ef9f9a4dedcbfe339f4f3d07fb614645596c6f2b15608bdccdad492578b735f7cb075bdaa07178c764582ee345857ec4665f90342694e6a60786bb3d9b3a3d23

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\1B1495DD322A24490E2BF2FAABAE1C61
Filesize
300B

MD5
dec6bbe308eb44937f77160a25ee32db

SHA1
8f08a4b641b564b67205e00106ca6bd9ca46fc6e

SHA256
68a71de28f488586c2b169f4652347e0a1fd632d48a6d6725393607bfa18bc7e

SHA512
6c2d684af52588cfd34a682337749b829c2336b34d6add7e8bd6e0c641862c26889617b4d6e9f298fd177b89527deb696c493a205ea8490bb8aee60090a68475

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize
1KB

MD5
d09b12af69c9ecd7e0c67fa6f4079687

SHA1
cd7445e61189759ae9703bcf894e6eabb73a528f

SHA256
5c95c41b2d9c5485ef7e9a5dc543c76ef4e0699398f3dda79f5116624dde477c

SHA512
cf791897a501ff03f2b952042389a0629ab65239aa716e4c3aedc61019139cd5c7495e122f11cfdbf044283ff5f7cc4e4368f3859fd820e71af55e56f8f5d279

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
Filesize
1KB

MD5
4c8f0d1fd5142e86be7908a7e625b4d2

SHA1
c446c20f4271b92c3bc60ed621cadeff27a67bf8

SHA256
ec5a02fc5bf94261e5aff87b9c6c6cd7bd41b9d1b597550edeae52f83a821e32

SHA512
aa81184f54e38982f28a53e3dfa82f9c880c6857faa709204a88f724369b8805adad50fd5913f011f91f2976620834ecc3e84dded0ef07aabd41563f0bb4e42a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_39B106F123768E115B76BB43FD900961
Filesize
1KB

MD5
c188d67930a09712452c1c9ce0026146

SHA1
1bd0ea3e21ef23e6fc0f795afb96e71fa476b460

SHA256
14308e81341a5dabbad2e7b26ced47e0f9745ab09f54716519b7848e384f02aa

SHA512
0ebdd7a80948f9c0d82fd731a3e03d6fd78fcbd77b3c6b996003a1849871998c2525a84fc43b55443c33624f1ce4de828aa673e14e8bb4b7822ec00f1f91c01e

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize
724B

MD5
ac89a852c2aaa3d389b2d2dd312ad367

SHA1
8f421dd6493c61dbda6b839e2debb7b50a20c930

SHA256
0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45

SHA512
c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_0FE0C38FA389BB89AC6FA011EE620F62
Filesize
472B

MD5
1b175d94306fceeabfba17df3e707e07

SHA1
ee96e3c5210457462b12fa7b68c74ec22306726c

SHA256
387f135d0815547613eec6c3165ed22488e38fbe7ed3659f85da1da99f521f90

SHA512
a41d7bc88b3d946adf3eea1c0de149d043585a817d66cb083037905366d3e94a4cab01a3b1fbbe347c793a11de96e7ed12b5d9ad0784e894ec27a0221aa3db0c

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Filesize
192B

MD5
75355d3fd7f387e80cf02ea185593a5f

SHA1
256a54bd8000496f4cc04a43ade6a805c8b14973

SHA256
bf287719271fd2fffc74789a80456b70e7ae24626cc40ba5a454d9ee7b7a811b

SHA512
cb0b5dc365f49190f1ba97faa1ca5da5e8cffa267e9b66ff5b48b73dff71712eb5fe706e07abcb0c14d1015476a1841ca1b3f96cbc140b36395b9f7fbc7a333b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\1B1495DD322A24490E2BF2FAABAE1C61
Filesize
192B

MD5
e5e22ba49cd7c587d398ea83c547c1de

SHA1
e78421296a1dd59c6d3c393c11e0b29e86c88b66

SHA256
00aceb7ec1909af8ca1b17871be9b1b0e1834548d870fd3d33941aec8c436473

SHA512
d422198e7f4b1126c3bb2d548292e98b8dd90072c75d4e9eb500ac7c1b48acc7b341f22e29f3e922924b09c85df055ea6f90136f8f4a454065c7536176caeb5b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize
410B

MD5
1f4c12156d6d6a09ecf78bf4dbfb738c

SHA1
73accce1a585db5399ce83d12e42cb9569b22e43

SHA256
9d1beafc486f39c45184b275469ff876d7df93b8946cf6d5c29f5e82a38ce38e

SHA512
69c84521c2df8ca9c7b1ba04c61ea4689e3322c5b90a4ecfa400e60fa30739a5b1bf7f22a4c69c70ee4638916970f394e8b588cfe87964239f4fca575a99d0dc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
Filesize
408B

MD5
f08eae3f5167a91df2d91304fead68d4

SHA1
1c3afc3153a3d2f914d993611786d490aacaf455

SHA256
f47f194b21574f9342affcaab77509bed23def8d9008d026289a20d10c0ac400

SHA512
1295edda9a070cd9c25e145306c8ec48fa068fad18ec33b70dba1a1b77b1ff9a2b072c301d13667e67e3b87128271c7f050d743c7827bef272e9c01176f6eb0f

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_39B106F123768E115B76BB43FD900961
Filesize
514B

MD5
59b4dad79af85b79784cb09d96f58e6b

SHA1
06eb50037ebddd3dfcaa2f3ae5355651163e224f

SHA256
c06db631f3926dea83169992a54056ae0fb88ab6414ef478da6b9dea0ab22ffa

SHA512
13111cc0c57b2d6849a19a9c7c1f5abe63e44699c67cb20eb76eb141ffcc7d374a70b521aa92692edceeefefc225c4b104697aa57b0a517192d3caf497a5ba49

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize
392B

MD5
bc6456b31eaadfd7a679336da4d59b5d

SHA1
8820a92c4956719498f6e7a48dd7da5e696b7ac5

SHA256
50afa5f8996ab7a6a7e0007e1eb12247957a654d055c9dfdc65f8827e69c1bb4

SHA512
304a724a61605c7d3d821a75f5c0afc39c6843a75cefd92137bdd50c069dbf7f022f5258c28bc1d623520351594a6e4fac4b055fd067f0a7db1fadcc51a3c2c5

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_0FE0C38FA389BB89AC6FA011EE620F62
Filesize
402B

MD5
eebee2b6e73eea56a9b496737b0eb7bf

SHA1
bc2821ffd1ae3c93e54d088c6709129a53bc52a9

SHA256
664779eec57060136872a476f68bd987654a45bc4e20905b413a9d89762624b2

SHA512
f4dc307587d41e771c46289e884e87b74eaa2965aaf758420ff87ff17155909a46993f931e57360ca252b18414d98d178bb6ab4bd3d738a8e052e4d0058ed85b

Download Submit
memory/344-203-0x00000229E1F80000-0x00000229E1F81000-memory.dmp

Filesize
4KB

Download
memory/344-202-0x00000229E1F70000-0x00000229E1F71000-memory.dmp

Filesize
4KB

Download
memory/344-0-0x00000229DB820000-0x00000229DB830000-memory.dmp

Filesize
64KB

Download
memory/344-35-0x00000229DAAF0000-0x00000229DAAF2000-memory.dmp

Filesize
8KB

Download
memory/344-16-0x00000229DC100000-0x00000229DC110000-memory.dmp

Filesize
64KB

Download
memory/3184-131-0x0000022BDF780000-0x0000022BDF782000-memory.dmp

Filesize
8KB

Download
memory/3184-428-0x0000022BDF760000-0x0000022BDF762000-memory.dmp

Filesize
8KB

Download
memory/3184-426-0x0000022BDF6C0000-0x0000022BDF6C2000-memory.dmp

Filesize
8KB

Download
memory/3184-397-0x0000022BDF920000-0x0000022BDF922000-memory.dmp

Filesize
8KB

Download
memory/3184-217-0x0000022BDF0E0000-0x0000022BDF0E2000-memory.dmp

Filesize
8KB

Download
memory/3184-215-0x0000022BDF0A0000-0x0000022BDF0A2000-memory.dmp

Filesize
8KB

Download
memory/3184-137-0x0000022BDFA30000-0x0000022BDFA32000-memory.dmp

Filesize
8KB

Download
memory/3184-134-0x0000022BDFA10000-0x0000022BDFA12000-memory.dmp

Filesize
8KB

Download
memory/3184-128-0x0000022BDF720000-0x0000022BDF722000-memory.dmp

Filesize
8KB

Download
memory/3184-125-0x0000022BDF6F0000-0x0000022BDF6F2000-memory.dmp

Filesize
8KB

Download
memory/3184-122-0x0000022BDF6E0000-0x0000022BDF6E2000-memory.dmp

Filesize
8KB

Download
memory/3184-119-0x0000022BDF660000-0x0000022BDF662000-memory.dmp

Filesize
8KB

Download
memory/3184-117-0x0000022BDF620000-0x0000022BDF622000-memory.dmp

Filesize
8KB

Download
memory/3184-113-0x0000022BDF530000-0x0000022BDF532000-memory.dmp

Filesize
8KB

Download
memory/3184-108-0x0000022BDF3F0000-0x0000022BDF3F2000-memory.dmp

Filesize
8KB

Download
memory/3184-103-0x0000022BDF0F0000-0x0000022BDF0F2000-memory.dmp

Filesize
8KB

Download
memory/3184-65-0x0000022BCDDC0000-0x0000022BCDDC2000-memory.dmp

Filesize
8KB

Download
memory/3184-63-0x0000022BCDDA0000-0x0000022BCDDA2000-memory.dmp

Filesize
8KB

Download
memory/3184-60-0x0000022BCDD70000-0x0000022BCDD72000-memory.dmp

Filesize
8KB

Download