Malware Analysis Report

2024-07-28 06:52

Sample ID 240613-2fkrrawhnq
Target 05ca8a26bb5261e2c6c8959d77c737ece50a1adc370067902c0b4f7789f18206
SHA256 05ca8a26bb5261e2c6c8959d77c737ece50a1adc370067902c0b4f7789f18206
Tags
google phishing
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

05ca8a26bb5261e2c6c8959d77c737ece50a1adc370067902c0b4f7789f18206

Threat Level: Known bad

The file 05ca8a26bb5261e2c6c8959d77c737ece50a1adc370067902c0b4f7789f18206 was found to be: Known bad.

Malicious Activity Summary

google phishing

Detected google phishing page

Checks computer location settings

AutoIT Executable

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Modifies registry class

Suspicious use of WriteProcessMemory

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Modifies Internet Explorer settings

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: MapViewOfSection

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-13 22:31

Signatures

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 22:31

Reported

2024-06-13 22:36

Platform

win7-20240220-en

Max time kernel

282s

Max time network

285s

Command Line

"C:\Users\Admin\AppData\Local\Temp\05ca8a26bb5261e2c6c8959d77c737ece50a1adc370067902c0b4f7789f18206.exe"

Signatures

Detected google phishing page

phishing google

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff5600000000000000dc04000065020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\facebook.com\NumberOfSubdomains = "1" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AE3AB7C1-29D4-11EF-A3F8-62949D229D16} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AE3ADED1-29D4-11EF-A3F8-62949D229D16} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007f24622b1f2f5446968cb28cbb509bb500000000020000000000106600000001000020000000eaaa397ac1a90506494c4c73eea5d4585192440f8db30d1bc1d3430abcd841d3000000000e8000000002000020000000b68d85968245b454060ec5d0c5a73dc6fc45c707b08a7aa55b1a4b1937e11fc190000000f44ab0321a7023706cefb2f7153d1d9790767c935e49521645fceac75aa53c51acf075bdc64789e9e6467598e30572ef13629e7b90d252b51a05ef01c4a6144dadacdc12a5c9f42e64e5bf425edb7310dee8754301f325e61cff9347073b987c48d88e19991511a6c19f1c384ff08f7b05c9347d4d7e9d0b3a1058a26bb8255506747ca0562f16019a81cfc88acac672400000001620a659c01401935f574a9357921881ea7c91de50a13e81623481293b08b60af06c2518654646d9ad93e986d00239990e05c0b188895c062935012d44fcec31 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424479827" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AE385661-29D4-11EF-A3F8-62949D229D16} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\05ca8a26bb5261e2c6c8959d77c737ece50a1adc370067902c0b4f7789f18206.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\05ca8a26bb5261e2c6c8959d77c737ece50a1adc370067902c0b4f7789f18206.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\05ca8a26bb5261e2c6c8959d77c737ece50a1adc370067902c0b4f7789f18206.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\05ca8a26bb5261e2c6c8959d77c737ece50a1adc370067902c0b4f7789f18206.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\05ca8a26bb5261e2c6c8959d77c737ece50a1adc370067902c0b4f7789f18206.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\05ca8a26bb5261e2c6c8959d77c737ece50a1adc370067902c0b4f7789f18206.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2204 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\05ca8a26bb5261e2c6c8959d77c737ece50a1adc370067902c0b4f7789f18206.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2204 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\05ca8a26bb5261e2c6c8959d77c737ece50a1adc370067902c0b4f7789f18206.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2204 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\05ca8a26bb5261e2c6c8959d77c737ece50a1adc370067902c0b4f7789f18206.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2204 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\05ca8a26bb5261e2c6c8959d77c737ece50a1adc370067902c0b4f7789f18206.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2204 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\05ca8a26bb5261e2c6c8959d77c737ece50a1adc370067902c0b4f7789f18206.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2204 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\05ca8a26bb5261e2c6c8959d77c737ece50a1adc370067902c0b4f7789f18206.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2204 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\05ca8a26bb5261e2c6c8959d77c737ece50a1adc370067902c0b4f7789f18206.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2204 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\05ca8a26bb5261e2c6c8959d77c737ece50a1adc370067902c0b4f7789f18206.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2204 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\05ca8a26bb5261e2c6c8959d77c737ece50a1adc370067902c0b4f7789f18206.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2204 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\05ca8a26bb5261e2c6c8959d77c737ece50a1adc370067902c0b4f7789f18206.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2204 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\05ca8a26bb5261e2c6c8959d77c737ece50a1adc370067902c0b4f7789f18206.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2204 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\05ca8a26bb5261e2c6c8959d77c737ece50a1adc370067902c0b4f7789f18206.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2224 wrote to memory of 2664 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2224 wrote to memory of 2664 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2224 wrote to memory of 2664 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2224 wrote to memory of 2664 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2700 wrote to memory of 2656 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2700 wrote to memory of 2656 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2700 wrote to memory of 2656 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2700 wrote to memory of 2656 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2900 wrote to memory of 2596 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2900 wrote to memory of 2596 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2900 wrote to memory of 2596 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2900 wrote to memory of 2596 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\05ca8a26bb5261e2c6c8959d77c737ece50a1adc370067902c0b4f7789f18206.exe

"C:\Users\Admin\AppData\Local\Temp\05ca8a26bb5261e2c6c8959d77c737ece50a1adc370067902c0b4f7789f18206.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.youtube.com/account

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.facebook.com/video

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://accounts.google.com/

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2224 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2700 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2900 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.youtube.com udp
US 8.8.8.8:53 www.facebook.com udp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 www.youtube.com udp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 www.facebook.com udp
GB 157.240.221.35:443 www.facebook.com tcp
GB 157.240.221.35:443 www.facebook.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
GB 142.250.200.46:443 www.youtube.com tcp
GB 142.250.200.46:443 www.youtube.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
US 8.8.8.8:53 m.facebook.com udp
GB 163.70.151.35:443 m.facebook.com tcp
GB 163.70.151.35:443 m.facebook.com tcp
US 8.8.8.8:53 accounts.youtube.com udp
GB 142.250.187.238:443 accounts.youtube.com tcp
GB 142.250.187.238:443 accounts.youtube.com tcp
US 8.8.8.8:53 static.xx.fbcdn.net udp
US 8.8.8.8:53 facebook.com udp
GB 163.70.151.21:443 static.xx.fbcdn.net tcp
GB 142.250.187.238:443 accounts.youtube.com tcp
GB 163.70.151.21:443 static.xx.fbcdn.net tcp
GB 163.70.151.21:443 static.xx.fbcdn.net tcp
GB 142.250.187.238:443 accounts.youtube.com tcp
GB 163.70.151.21:443 static.xx.fbcdn.net tcp
GB 163.70.151.21:443 static.xx.fbcdn.net tcp
GB 163.70.151.21:443 static.xx.fbcdn.net tcp
GB 163.70.151.35:443 facebook.com tcp
GB 163.70.151.35:443 facebook.com tcp
US 8.8.8.8:53 fbcdn.net udp
GB 163.70.151.35:443 fbcdn.net tcp
GB 163.70.151.35:443 fbcdn.net tcp
US 8.8.8.8:53 www.google.com udp
GB 142.250.187.196:443 www.google.com tcp
GB 142.250.187.196:443 www.google.com tcp
US 8.8.8.8:53 fbsbx.com udp
GB 157.240.221.35:443 www.facebook.com tcp
GB 157.240.221.35:443 www.facebook.com tcp
GB 157.240.221.35:443 www.facebook.com tcp
GB 157.240.221.35:443 www.facebook.com tcp
GB 163.70.151.35:443 fbsbx.com tcp
GB 163.70.151.35:443 fbsbx.com tcp
US 8.8.8.8:53 scontent.xx.fbcdn.net udp
GB 163.70.151.21:443 scontent.xx.fbcdn.net tcp
GB 163.70.151.21:443 scontent.xx.fbcdn.net tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 204.79.197.200:443 ieonline.microsoft.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
NL 142.250.27.84:443 accounts.google.com tcp

Files

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{AE385661-29D4-11EF-A3F8-62949D229D16}.dat

MD5 36b06a3c82c8c35641512680010b3a4e
SHA1 707de0f8d4d55fc8ca6bd744424a3c31ea6a6435
SHA256 f3fdf2159346262a0e66fef71a3da214494e0853d61ae5b61254f7f4ee5b1153
SHA512 222ad1240bb66fcdc18c8893046ef6582be05490cd96b0751ff946569c3c701905919e0908eac0ec7d5274d4715db1d82bc9ef0820e0f780686d3353bc4525ef

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{AE3ADED1-29D4-11EF-A3F8-62949D229D16}.dat

MD5 29b2ceafef5aa99e6ee27aa5393cfa68
SHA1 17b378cc0df54b2138deb47a2245d4ce31a06164
SHA256 84a95167fc8223a3b643abce2a8178b1837c6b778dfb0e16a4b4bcfdd43af052
SHA512 af0c21dfafaeac0590381dc0695b48cd50b6f433a16d6f8b18263eba77ba44107129e153687b8bd194f49a34a22d63bf3de1e56675e5db4f29a03e172c131a80

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{AE385661-29D4-11EF-A3F8-62949D229D16}.dat

MD5 b68d9edc51f7d8d8fe45f27e79421409
SHA1 133991bcdde0d51aef583ad9a35c5d64220421a2
SHA256 d6ae512a1ab6b26997468110d91f7d1c6fea05fa7004cb8e0c6dc120873b05a8
SHA512 72dd0ecddfe0deda205011c16b4d143b55bf5f0b25147c9c21b589ec27bb379a4ec47d17cef82eee22711479ebb5fd6a3ce7c1e520afd750af736bfacbaee462

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 0f59d2e31293ea028db31a7196035399
SHA1 7629621262a66894fd304e92aff41e68894d0620
SHA256 75a5c6a91c1d343a527f5a298b77c55521fc05b4601ce7a5c92bbe7925feea6b
SHA512 22328d6def7a3a23bd7537fea170fe5621676d511714a5abcad2ef239709f8c3909bc443b0bb66fb2dd002317d89c7c11f0576886e4cff51d0a67a412f73cba4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 a08991b3b3149042115bebb75a76ccc0
SHA1 4f1a11c57b43422713fcb9c7af450a3a547ad11d
SHA256 827224a17beecdd911e49e0f09ab9665246f781744d1241545d6aefe2e67c788
SHA512 dc3f8319b0a7ab3e3a37447cdd60b3772bbb5e73cd44e9e58c2ad979dcd68f48f675c8a0a2626e9d3af5d4c664a9dcc52b786b69946236d8f89d12371d987fac

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 f62f69427a0097b85bee9d82873df5be
SHA1 1eaab42b0eefad06b32fa310e2393601dd970219
SHA256 17aeaa94b76e48683c084d080a1628b41f7482099dc8f1875acf3b16d5d13f3c
SHA512 35ab5aaa885f0b76ac217276a7cdedec623a52e15a973b04847c396bcbffb4d06c00f7979f503198d3096235004fd88aaae9a8a541783750a20e8f74473eacab

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 ac89a852c2aaa3d389b2d2dd312ad367
SHA1 8f421dd6493c61dbda6b839e2debb7b50a20c930
SHA256 0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45
SHA512 c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 7df9dbee879a427e01323fffb029cffa
SHA1 0e70543b538045f87f15a47517eadc7213ef6d1c
SHA256 de2a5db41b8bae3158c44e85d60e2a532045c54a91cd7fe0b12e1d9f7712f8fb
SHA512 9c92bf63f0906dd5d38ecb7ff679c01dcb1eb0bb4168c18a89abcd321d8e331a012d1d40a90b02703b8cf27ececa9b3e39ea46428ad8755750c244dd42945527

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 a6566ed819f343ef8244bf47b46bb8f1
SHA1 d824374c9b8a7aa9c2c144156d0f16e1a87555a3
SHA256 99586009b06845a9c97483abb53316ade6f7f9a5c85c1c4787d15e64ddf2483f
SHA512 65fb29702bdf6214058ac8da22b089554b6ab38dd261504f69bc5a14d37b303d1df7c8ebe481ecb7281ddd05f839e9ca4f3a2457f42244b8cffe7344d4359187

C:\Users\Admin\AppData\Local\Temp\Cab24B0.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0f1072377395b1ed137f6072d41ced9f
SHA1 d3682163eab0e0f8754e6ba8f178ec55a659ab13
SHA256 a014ec597a3aa3f7c455288de9dfaa3136290ef74b8fc1caa34d325c73d0f057
SHA512 d0995158c1d7c548f74274aa6ba4e7ffd6a2288f97807c8a2a02e674ba3eee3cdbff7a25c8e89d265cc56072d933f6d72feaad362f986fd270c4d0705ba6e353

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\JHLW43CV.txt

MD5 17f6b2b0b34b0eafde2d5df6db9e6f90
SHA1 6ec5a7b358f3dbad2f4c15fa30d9620877d4226c
SHA256 b92c5256c1c9e3b7591cc4a1b21714c3de5201338446960e4decde3414aae02d
SHA512 6eaa47f2b4a4292f0eceb40d0c7293d7a6bdae7d41443d1e0d41f734517d02f95004ac8d8d6f86149722c62b0c489a942c41a3aa3cafcf440e654e40d292a02e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_120148DF360AB0CA4DEE7F56782F4D54

MD5 3823f902540305efc41105899c1e0dc1
SHA1 10a927d26e91caab97aba1447adee2208140b021
SHA256 4380602945f843080a9bba25095077fbbdc030e226998858e360ce204b80836a
SHA512 140a566fccbe042b7461757b41571509dd70619138aec6c3591a29dbddb8c6584f27b6e84d21410ec343d78d3795dcc50b6509374bc7bf6064759acb177250e0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_120148DF360AB0CA4DEE7F56782F4D54

MD5 21dc9c9cad0006d4508fe54dc072ca9d
SHA1 633feaba7a517c71212da1d810e8c4f7746557cf
SHA256 954d5585ce2f39701832a632362a69039de4fde9a144873dd5da4ec6b1ff0c96
SHA512 cceb8e1502a62ac137f7f91396a5c098202811c6e02c8dcf4e33cca697c01d154b1d945ceb9363b0831df9e29f4421ebda0d3ec59dea0d5f3bbb77d9a8c5c4d2

C:\Users\Admin\AppData\Local\Temp\Tar2790.tmp

MD5 9c0c641c06238516f27941aa1166d427
SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\KXSMNWNB.txt

MD5 7769718c8557883ac0b1cd845213f4c6
SHA1 938831b29988f697b515aa50d2475ced6cb3d8aa
SHA256 e8041cebcb2b66d1e37986008b739263fe51fbfbee51eb8db4db6663d1a799ad
SHA512 aa1aa70cae51035e2016162e29837fb2bb023149f82af8ea76dc9a2fedb4de93cf776e017893108f266b6c6d0f1d32f1db792ca2c31d005316e87399ff2025bb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar28ED.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7654a6308f0caed72d275a591e626df3
SHA1 b980031cc306625a78bce82607bbd12146c14254
SHA256 6a9fe70aae496dae510bf2d56b1a5022fcaec7f3241b68eb4ec8fd67cdf76f56
SHA512 6aaa005a4ba33dbd7d47e3463a1dcf6dfafc17838e5268510587ba33ca519d56a09918e8a24dcbf91978359d50a3ea3622774ea671b11a8d25adbe94eb58abfd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_5E390E1CA50E646B1021D6CAA485D322

MD5 37471e0cd76a4845fe84ceab8bcc89ca
SHA1 ca299764dcdbfcf317dc20d34c5792f9e4547d3d
SHA256 71213df8eac6498ffbb74e7b9eadc8a52234e17c516cbf4c020c37ab8a874fe7
SHA512 a49892615026be951861f337cd2d621e6d3f09af119623671d5e248b09c7a7bd159688cce4c399cd3202a3fe9a186c16634596ac2e57c2c0739246e020d154ed

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_5E390E1CA50E646B1021D6CAA485D322

MD5 a6fd7c911e9165cf8e187a0b229d7736
SHA1 d819d274f4d34f7ec719ab00732a6ce11ca57b72
SHA256 acd07b71b98bb597838785a568ef2ff11127ed352abf45821f4fed6b7c30bc60
SHA512 8ed3878df42ef8d2b9210fdaad47227c5dc42a3873f7c5db2f64d4b295876fcdc5ea634dcb10fb1d837f3a2ad6250b97d287356e2be91925f7e9e7b2cc75123f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5d1f18ca9860ee84fd42251a7af7a6ca
SHA1 4ff6357dac8d90e823f266e31154e9a275264d08
SHA256 71f752bae4dc721bcb3e57ab568708fb68231107fe88a9b1737ddaba3c3ec524
SHA512 d9d3aa1d17b7dd40dfa24dc57b7876ccf756bfc6e6d9cc94b154c352a3b02eb648fd794868cea6af3ae36c9d6d545ecc5bcbdc013b40973ff7de876265163be1

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\GSM25076.txt

MD5 cf3ed7fe8ff3d99e421a7b465a866c73
SHA1 1832394d08a1e099520fc0814c8063fd5b0b35d0
SHA256 738a917d7db01d1c8d2dc97b6cd1cef4176984ca3c80dd007fe3bad28883feb9
SHA512 24c255af55ed8cf974ccdb1596f2ee64a154da5793f61e208e636f7e7157b19199b0c5b386b46837920c1c7fa8ba9c6280ac83944ba396a6d5e04c077fdca053

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\FQKMIYPE.txt

MD5 bb2a8bc4aa7e8b04c884c5e350583df5
SHA1 31745dca385e06a129ee53d21c95fe99c1753431
SHA256 18098bb2eb5a56637992508da04b22aafb357cd3052ea4415a209e8e74a120a4
SHA512 9bb16264d1752a9a0f211dfa345c7dec00c75e255c7d2677b00e2fd7244e19b4e572a060c0779ed656701157f9650b72e10a66d1535c226d89f42ef8222e205c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_89FBEB9EEBFF8AABF1EBFA20B87AFE7E

MD5 e8b5db0ae8c5fcebc669dffbcb065526
SHA1 a559e084ce3484603c8712ed5696c007daaeb9a0
SHA256 d32935080ef6d293c85f45a4d40c341c587dbd128396789f2f22100ca6c78483
SHA512 50e3a5d2abc5eb214172e14f0b2aa354ff793882fffaa1d140e8ed6f4ab9eaa6d37020883011facbae1e50e10c465178af574e8feab61fef9ea62cf1e39940a8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_89FBEB9EEBFF8AABF1EBFA20B87AFE7E

MD5 74d06f968826184f62e60212c6d0f9eb
SHA1 862d71d510f997f9ab385374912e24d2579df9d7
SHA256 4adde5fb90668314117d2d8ab4e899b6926bbfdd6abc2214f8923773c5812343
SHA512 9c3d9af04fc4699bf528b183b5d666158b2ecb60c76b722498fb6f43141a678fdd1c7329cf4ca572e8f1caa4f3daeca28628b713cea0e3ba62bd50fb186363ef

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\K11GQ3CV.txt

MD5 81936c188b396a704a680a0204f326a3
SHA1 fac9d39a889e0d8d04262b11b94026f70a0ac6e4
SHA256 92ff01fad21688feed3dd809bb86e87020ac7688deacb7a3cd26e1ef7c8eb12f
SHA512 884fefcfda2c7e2192d09c84177808d9c830137e0bfeef442a2c4651219f8bee75b3b36ee17813fdf16cde3126a3a38c7325117664ef50b6587a3fcaa2d11052

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RSAB58HZ\favicon[1].ico

MD5 f3418a443e7d841097c714d69ec4bcb8
SHA1 49263695f6b0cdd72f45cf1b775e660fdc36c606
SHA256 6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770
SHA512 82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\ATP8D6QE.txt

MD5 afbf9003371ea3bb7f029efb972bb89a
SHA1 d704101c6bd8c1026da83cc0f6cafba9fbcfcb04
SHA256 d5d6311cbd523f7725f7776f72e9fb199e5f296ea2901df8add1ac23d26329c6
SHA512 3ffeefd9f7a54de70ae348eb3d69fcb2f4dc656b52b58fcae01a174881ade99ccc793aa1c299b42e5563d252ff545f64425d02ad5cbb1ae6d908f8561ded348b

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\jw2rl61\imagestore.dat

MD5 7275efd6c1a7bf678ec6ff4d9b09ca5d
SHA1 8bf1d2abcdf2d786d7238823f12f293605a05851
SHA256 0f50cf46e8245b475d79f43c641c5626a2d671f16731658abdc66eb13d9e66a6
SHA512 d75824cc2217944a49cf90c15277fc14bc01d816ff563a9f48b9f6d263a8518a2e8022dfd6f1382e98a6fb4a042ad88e13b1207c7f2a58ce90c30fc97c66b94a

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\jw2rl61\imagestore.dat

MD5 f676cd3bc0de38ce52e2a537206d8b74
SHA1 1039ac2a7bf75e8e1ae148aaf662058ca87c0990
SHA256 b51aff0fd774d0ce90431556f939b0da7ecbfd92c11f31872ba41c861da6d9f8
SHA512 3c9f68931eae228febab805a020f85218022720865e30ca4d06913915e2cb4687f5bf9722300271c801b0123b4530b2f7cd847e66b77a13023d99c7743c54930

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RSAB58HZ\4Kv5U5b1o3f[1].png

MD5 a81a5e7f71ae4153e6f888f1c92e5e11
SHA1 39c3945c30abff65b372a7d8c691178ae9d9eee0
SHA256 2bc7a47889c56ad49f1b8b97385d5a4d212e79bb8a9b30df0665a165f58b273e
SHA512 1df32349b33f6a6fcb1f8b6093abd737fa0638cdd6e3fd90a7e1852bd0e40bc2633cb4e13c4824fb948d1e012e5cb9eed0b038b121404865495d4e57e123db69

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\jw2rl61\imagestore.dat

MD5 596c58eaa6db3d015f2166a7d6e1b0ce
SHA1 ab406f0979ea63f60a3ae8ff86bb2a7bc13f000d
SHA256 9714882ccab1ac53d0c694ce7a1e8a5c6b18733298bad50a6bc07e9b1896a116
SHA512 a9917c6f41e1e92164ed6c8a7a37338265f9ab82875af4ad985ce78dac58a57696c9ec2a47575257eb719456c395a19b01fcf2eceab5f8a0e04e25b2e5f77d1f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d2242e958e014c5b714a32142a8cd7fd
SHA1 f3c38383f319648b4a5d897b1786e3f5328931c1
SHA256 ba336dbbe4b78b6c228f5ef4c7506a234092590ba01be492ac644a9f6d6bb800
SHA512 3e231300129ff1c195e8a51c64adef9415e8211c5d0013e8d694deeaf23cd405d2cd6b0a0aabf5b698602eb43baf735ee5a5685fb34dc8ba0fb2a7982685c094

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 532ad0a47807449c4e22584abdb537fb
SHA1 9b06686165c5e0588555830ecfc70e45059b410c
SHA256 6c3f4cfdb80e8f02cd1ab34c609fa07ff4960f3d30b9b8bcd935fd2af68db315
SHA512 ad480f7f6e4a7b5a28341de70e3650d838d9abb11937b685dbc7c41e8828587600b8ac6850f93168384b85578e1c795667d8a3bd5258df08ecde29b304eb1d69

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 adb53eeebbb720c568ffe180d2691193
SHA1 ff6a6fe66278a276bc171fcd49135c0eaaad09ce
SHA256 c59a661a0308d243d0a06bb23be631f1c93d7e30a28561b8606d36fdd2ce5522
SHA512 27dec52aa95ea227d0fcf0596d68fa7f1a2709c007bea94209fa83474280b90495f7d5ac38fe57f79777633ece168e80b7f4f2d1fbc71a096739d8df5893ee18

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d3a681a0d2fd555cee1f50307f8326b0
SHA1 6392bc2e7fb6acdf458c9f0479bb6043d005f5e2
SHA256 e3261f8e569b9c4b9e830ced49f7b8993954773d00e6336dd41cb893e95efa12
SHA512 0385cb5081af060c651c74ff318d53e6aa4a9fb251eb8ad20448c8aba355efbdfb023f325034e4efcd478198c2314d6dd693efddb0f8f15075f15475f75c3920

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 70e8af42e193f5e6070e3e2b36c50cf1
SHA1 4137d8ee1da83deb5dfb8edea00a794d0c72c895
SHA256 aae723a362708b1cfb51d1504196238313c5f4e003e582c5a01803bdea38a535
SHA512 aec39ae8378b6e01b9867240fb93945f03f81ebb3598cef458ad7f152e8084378752699d0925306102a10de752afffae85c6a0d09adb2844d4284389a274c4af

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 67df7a2bc52ef496f549b619b31b6934
SHA1 fc43854fe3ce57afe903f89745f338f010051680
SHA256 136be8d2532ae17da78df3d5f424a24d0cd83680a4c1958087331b82a8a0e375
SHA512 9605ab135e3e28408c055fbd89fc339f4c1c65abd3da0392c976480f088729dbd24843dbb4fdfdcceb541442ceddcfc9e2f71e018afff5efda09888240fb9b49

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a2c10610853730c4d366d425e502984a
SHA1 5ae97c039cda1d75c0362d7fd3efaaeffbf519f7
SHA256 4efa9a60e57410ec15f1d3483454c799f59704710959823fe455834c18eba1d2
SHA512 619b8b98da9bbf6a7685d876d2b7c89ff27c860a15d33ccbfb76d003a91ad67f84e1bb3d2a197b693e921399ac0f76a9c859745c9f4d306b41b0bc090221f32a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3466f58a36e2e99aa2fd376e2c9a22db
SHA1 7d89f587f2f4c3b0b7e0f33896ad5c3cbfeff833
SHA256 8bee3e28586961f481e4dd2694ea9c198341ed1ccc1347e9d7c6c51ed3cfcc50
SHA512 8ba6f71b653769f87d1b243a455dcfaf5183695b17f8b178d492b85ad5721f9eec131959d5b921eeee2cca5b893d883454cdb515171552db69cd1aa3d561fe7b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 05201a7c1dd04e6a90ff4c4080f87fc7
SHA1 ad400b0831f4684c64f9ea433d3c153c32993195
SHA256 65410526008ace5e54b91cee606755d699d33529809c0a9c7d0ff6ff01c36b5a
SHA512 a28795903d66fac8f5127190ec2727a5c2210b7f6a453b974e9224988f4e88996de2e577d46fa42c199120a19d677f7a4c8dd47b982372e7d8ebb28a30df7b96

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a5de5b4e3b3eeec39015d835025af903
SHA1 7833512bdedaa978de06c70e43b7b3b03858103c
SHA256 b180817fa1311fcc7a7670d9a17e9492d2c7db16dfbd3404862e95e75e5c3e61
SHA512 cf4c29ae7d536076ddae40530d533c5de139bb7f560a4567a98b1d4290aaa7fcd28646a465675bb8ce93d77e9eea9a599c1db3335a73b7f3d5dcfa65d7ff606c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 c12d1722b2e81cff342576779d4dbeb4
SHA1 810336a552d295c0248d14ca1240ffb22fc57657
SHA256 902bdf044640549c26b0d87cbe34cab16e92a141a06323c456c69a0cf7b16e30
SHA512 1dea6aef172ae9422424039f56d29a161a57998073b8b56da4aaa7b8ca4f0eff32e04a0ac3151f88d3d6fd571a45f415da5a38204c653e9aa1447847099825a7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 3ee11167eebe935e940a1ade39b79670
SHA1 6f1767f8020decc630b76200225f1b4b0cf442fb
SHA256 a37b27b08d7ea36743e9009c50e86ff3a77259ec85cd716ec6161875a52ed10d
SHA512 a3113265e8f256af57de2827a0d23aa4d6a0501a56dad86ab6b7067787364bd46cf77ea4d188e82d30bf8fac32f219607697577225cf1baf4cc66153fd407baf

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\D92KX2WX.txt

MD5 4fcaa9d13018322c79e089cb87a959e9
SHA1 2a3fce4422934e277c9757800b84257f6d953514
SHA256 5158de5f5b2a3031220b9faae8c2b53ba1d9376c27b586fd3b1bb536bdd34522
SHA512 6f15d297d2bb42529c4198a43271f96e234bc1082cc65cb61a0476a02d8a7c1bf76922700c68cd9c76edabe06395bebc585ed32b1a4444e0d9e38baf7732642c

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\C00KTMTE.txt

MD5 41c96a0060041068320ef2c1b9ce3fc7
SHA1 199c51d1b0c3a6079092e678ded579af18d18c26
SHA256 df47ed6f61414f7ecc2560d58c1316e4051d47d4e9c66687232a993a5567d1ce
SHA512 43c5e535a4950a7b1b62acd062b8a6c8712fc127fe37186ff946666dbf412556c1c9acfe2594716e17cba82926961c967d812bd0a438d5fb11f5032b090b2328

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 22:31

Reported

2024-06-13 22:36

Platform

win10-20240404-en

Max time kernel

299s

Max time network

299s

Command Line

"C:\Users\Admin\AppData\Local\Temp\05ca8a26bb5261e2c6c8959d77c737ece50a1adc370067902c0b4f7789f18206.exe"

Signatures

Detected google phishing page

phishing google

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\05ca8a26bb5261e2c6c8959d77c737ece50a1adc370067902c0b4f7789f18206.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\rescache\_merged\3720402701\1568373884.pri C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
File created C:\Windows\rescache\_merged\3720402701\1568373884.pri C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
File created C:\Windows\rescache\_merged\3720402701\1568373884.pri C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
File created C:\Windows\rescache\_merged\3720402701\1568373884.pri C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
File created C:\Windows\rescache\_merged\3720402701\1568373884.pri C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
File created C:\Windows\rescache\_merged\3720402701\1568373884.pri C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
File created C:\Windows\rescache\_merged\3720402701\1568373884.pri C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
File created C:\Windows\rescache\_merged\3720402701\1568373884.pri C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
File created C:\Windows\rescache\_merged\3720402701\1568373884.pri C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
File created C:\Windows\rescache\_merged\3720402701\1568373884.pri C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
File created C:\Windows\rescache\_merged\3720402701\1568373884.pri C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
File opened for modification C:\Windows\Debug\ESE.TXT C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
File created C:\Windows\rescache\_merged\3720402701\1568373884.pri C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
File created C:\Windows\rescache\_merged\3720402701\1568373884.pri C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\system32\browser_broker.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (data) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 0000000000000000 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\SharedCookie_MRACMigrationDone = "1" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "268435456" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListFirstRun = "3" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState\EdpState = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\Total C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = aec48377e1bdda01 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B7216 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\CIPolicyState = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "1" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "395205405" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\facebook.com\ = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\NextUpdateDate = "425131455" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{C8C92FDE-0AB8-4331-BF44-E665EE191D82} = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Extensible Cache C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Extensible Cache C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "268435456" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\facebook.com C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\facebook.com\Total = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$vBulletin 4 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 06f70084e1bdda01 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\m.facebook.com C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
N/A N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
N/A N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
N/A N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
N/A N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
N/A N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
N/A N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
N/A N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
N/A N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
N/A N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
N/A N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
N/A N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
N/A N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
N/A N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
N/A N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
N/A N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
N/A N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
N/A N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
N/A N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
N/A N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\05ca8a26bb5261e2c6c8959d77c737ece50a1adc370067902c0b4f7789f18206.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\05ca8a26bb5261e2c6c8959d77c737ece50a1adc370067902c0b4f7789f18206.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\05ca8a26bb5261e2c6c8959d77c737ece50a1adc370067902c0b4f7789f18206.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\05ca8a26bb5261e2c6c8959d77c737ece50a1adc370067902c0b4f7789f18206.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\05ca8a26bb5261e2c6c8959d77c737ece50a1adc370067902c0b4f7789f18206.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\05ca8a26bb5261e2c6c8959d77c737ece50a1adc370067902c0b4f7789f18206.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\05ca8a26bb5261e2c6c8959d77c737ece50a1adc370067902c0b4f7789f18206.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\05ca8a26bb5261e2c6c8959d77c737ece50a1adc370067902c0b4f7789f18206.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
N/A N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
N/A N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
N/A N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2848 wrote to memory of 5080 N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
PID 2848 wrote to memory of 5080 N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
PID 2848 wrote to memory of 5080 N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
PID 2848 wrote to memory of 5080 N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
PID 2848 wrote to memory of 5080 N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
PID 2848 wrote to memory of 5080 N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
PID 2848 wrote to memory of 5080 N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
PID 2848 wrote to memory of 5080 N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
PID 2848 wrote to memory of 5080 N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
PID 2848 wrote to memory of 5080 N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
PID 2848 wrote to memory of 5080 N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
PID 2848 wrote to memory of 5080 N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
PID 2848 wrote to memory of 5080 N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
PID 2848 wrote to memory of 5080 N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
PID 2848 wrote to memory of 5080 N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
PID 2848 wrote to memory of 4260 N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
PID 2848 wrote to memory of 4260 N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
PID 2848 wrote to memory of 4260 N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
PID 2848 wrote to memory of 4260 N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
PID 2848 wrote to memory of 4260 N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
PID 2848 wrote to memory of 4260 N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
PID 2848 wrote to memory of 4260 N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
PID 2848 wrote to memory of 4260 N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
PID 2848 wrote to memory of 4260 N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
PID 2848 wrote to memory of 4260 N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
PID 2848 wrote to memory of 4260 N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
PID 2848 wrote to memory of 4260 N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
PID 2848 wrote to memory of 4260 N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
PID 2848 wrote to memory of 4260 N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
PID 2848 wrote to memory of 4260 N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
PID 2848 wrote to memory of 4728 N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
PID 2848 wrote to memory of 4728 N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
PID 2848 wrote to memory of 4728 N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
PID 2848 wrote to memory of 5968 N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
PID 2848 wrote to memory of 5968 N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
PID 2848 wrote to memory of 5968 N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
PID 2848 wrote to memory of 5756 N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
PID 2848 wrote to memory of 5756 N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
PID 2848 wrote to memory of 5756 N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
PID 2848 wrote to memory of 5756 N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
PID 2848 wrote to memory of 5756 N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
PID 2848 wrote to memory of 5756 N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
PID 2848 wrote to memory of 4208 N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
PID 2848 wrote to memory of 4208 N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

Processes

C:\Users\Admin\AppData\Local\Temp\05ca8a26bb5261e2c6c8959d77c737ece50a1adc370067902c0b4f7789f18206.exe

"C:\Users\Admin\AppData\Local\Temp\05ca8a26bb5261e2c6c8959d77c737ece50a1adc370067902c0b4f7789f18206.exe"

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca

C:\Windows\system32\browser_broker.exe

C:\Windows\system32\browser_broker.exe -Embedding

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.youtube.com udp
US 8.8.8.8:53 www.facebook.com udp
GB 142.250.200.46:443 www.youtube.com tcp
GB 142.250.200.46:443 www.youtube.com tcp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 46.200.250.142.in-addr.arpa udp
GB 216.58.201.110:443 www.youtube.com tcp
GB 157.240.214.35:443 www.facebook.com tcp
GB 157.240.214.35:443 www.facebook.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
US 8.8.8.8:53 110.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 35.214.240.157.in-addr.arpa udp
US 8.8.8.8:53 84.27.250.142.in-addr.arpa udp
US 8.8.8.8:53 98.251.17.2.in-addr.arpa udp
US 8.8.8.8:53 m.facebook.com udp
NL 142.250.27.84:443 accounts.google.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
GB 163.70.151.35:443 m.facebook.com tcp
GB 163.70.151.35:443 m.facebook.com tcp
US 8.8.8.8:53 www.facebook.com udp
GB 163.70.151.35:443 www.facebook.com tcp
GB 163.70.151.35:443 www.facebook.com tcp
US 8.8.8.8:53 67.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 35.151.70.163.in-addr.arpa udp
NL 142.250.27.84:443 accounts.google.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
GB 163.70.151.35:443 www.facebook.com tcp
US 8.8.8.8:53 static.xx.fbcdn.net udp
GB 163.70.151.21:443 static.xx.fbcdn.net tcp
GB 163.70.151.21:443 static.xx.fbcdn.net tcp
GB 163.70.151.21:443 static.xx.fbcdn.net tcp
GB 163.70.151.21:443 static.xx.fbcdn.net tcp
GB 163.70.151.21:443 static.xx.fbcdn.net tcp
GB 163.70.151.21:443 static.xx.fbcdn.net tcp
GB 163.70.151.21:443 static.xx.fbcdn.net tcp
US 8.8.8.8:53 21.151.70.163.in-addr.arpa udp
US 8.8.8.8:53 facebook.com udp
GB 163.70.151.35:443 facebook.com tcp
GB 163.70.151.35:443 facebook.com tcp
GB 163.70.151.21:443 static.xx.fbcdn.net tcp
GB 163.70.151.21:443 static.xx.fbcdn.net tcp
US 8.8.8.8:53 fbcdn.net udp
GB 163.70.151.35:443 fbcdn.net tcp
GB 163.70.151.35:443 fbcdn.net tcp
US 8.8.8.8:53 www.facebook.com udp
GB 163.70.147.35:443 www.facebook.com tcp
GB 163.70.147.35:443 www.facebook.com tcp
GB 163.70.147.35:443 www.facebook.com tcp
GB 163.70.147.35:443 www.facebook.com tcp
GB 163.70.147.35:443 www.facebook.com tcp
GB 163.70.147.35:443 www.facebook.com tcp
US 8.8.8.8:53 scontent.xx.fbcdn.net udp
GB 163.70.151.21:443 scontent.xx.fbcdn.net tcp
GB 163.70.151.21:443 scontent.xx.fbcdn.net tcp
US 8.8.8.8:53 fbsbx.com udp
GB 163.70.151.35:443 fbsbx.com tcp
GB 163.70.151.35:443 fbsbx.com tcp
US 8.8.8.8:53 50.251.17.2.in-addr.arpa udp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 35.147.70.163.in-addr.arpa udp
GB 163.70.151.35:443 fbsbx.com tcp
GB 163.70.151.35:443 fbsbx.com tcp
GB 163.70.151.35:443 fbsbx.com tcp
GB 163.70.151.35:443 fbsbx.com tcp
GB 163.70.151.35:443 fbsbx.com tcp
GB 163.70.151.21:443 scontent.xx.fbcdn.net tcp
GB 163.70.151.21:443 scontent.xx.fbcdn.net tcp
GB 163.70.151.35:443 fbsbx.com tcp
GB 163.70.151.35:443 fbsbx.com tcp
US 8.8.8.8:53 161.19.199.152.in-addr.arpa udp
US 8.8.8.8:53 watson.telemetry.microsoft.com udp
US 20.189.173.20:443 watson.telemetry.microsoft.com tcp
US 20.189.173.20:443 watson.telemetry.microsoft.com tcp
US 8.8.8.8:53 20.173.189.20.in-addr.arpa udp
NL 142.250.27.84:443 accounts.google.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
US 20.189.173.20:443 watson.telemetry.microsoft.com tcp
US 20.189.173.20:443 watson.telemetry.microsoft.com tcp
GB 163.70.151.35:443 fbsbx.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 164.189.21.2.in-addr.arpa udp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 181.97.55.23.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 14.179.89.13.in-addr.arpa udp
GB 163.70.151.35:443 fbsbx.com tcp
GB 163.70.151.35:443 fbsbx.com tcp
US 8.8.8.8:53 88.251.17.2.in-addr.arpa udp

Files

memory/2360-16-0x00000243D2B20000-0x00000243D2B30000-memory.dmp

memory/2360-0-0x00000243D2A20000-0x00000243D2A30000-memory.dmp

memory/2360-35-0x00000243CFF40000-0x00000243CFF42000-memory.dmp

memory/2860-42-0x00000273A8A00000-0x00000273A8B00000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

MD5 1bfe591a4fe3d91b03cdf26eaacd8f89
SHA1 719c37c320f518ac168c86723724891950911cea
SHA256 9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8
SHA512 02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

MD5 47762ecd983c566eee1a198c2791c9e1
SHA1 9578cf11345c92cb97955f8c37ee9cbccdfccd30
SHA256 33b27b683e953bc60a6dc497b40b33f10638a4dc99325aeada97c6772e24b680
SHA512 4d4793ff5e7c6bcd7d3200b58985d48d9b713aa59c1818e0a6007385baa4db092984a525449c3bb6217a5b1e0e4caa74bf3819e252b965130e7bd8643dd9aa9a

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

MD5 9ef2ef118da1c91d53caf7823f91291f
SHA1 8467932bb1b22dae766efddc40f7556993bfb224
SHA256 f8b7ea4b07c9ce737fafce1de8276530c71526136d0103c5764ac0495372c38e
SHA512 163d9f79732345e94e091ce51604eaf0e7cc29f47ba1a5be6d493f9494f07a8d71ee5fac9f4227f70bef1cdcf96350fc1b4f280d64a4d44b01fc36e87f48f96b

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 479f8f857fd034f9c9a5e7fa7d0b31f4
SHA1 b6bff154d3c6201869bc6752a1cce51ef114c5d4
SHA256 9fb1e601a4dc213804b76fe814ee3fbc00ff8e28a9bb74926f9ed2adb0298673
SHA512 79a25a0903ea8f0ac19fa74aef84eebd381cbda55a3734a5933d02b56ab869efed39287e612086592ddc12a0375f6cfdbea29d284e91bc30e68d6871ac9bf204

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 a08991b3b3149042115bebb75a76ccc0
SHA1 4f1a11c57b43422713fcb9c7af450a3a547ad11d
SHA256 827224a17beecdd911e49e0f09ab9665246f781744d1241545d6aefe2e67c788
SHA512 dc3f8319b0a7ab3e3a37447cdd60b3772bbb5e73cd44e9e58c2ad979dcd68f48f675c8a0a2626e9d3af5d4c664a9dcc52b786b69946236d8f89d12371d987fac

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\C8B1G5ZM.cookie

MD5 b7dc052724314258d866687795d27214
SHA1 a2f181993101e4c20e8f8e1c8714639d619864cc
SHA256 4607ea86a40da318c11c3fcdbd88a66809eedb221e63b2959890d60e06ff8b26
SHA512 54cb9aab5e40c999c07ae8d10046b2f6d496fe24f1153ebd05533a2102b8428058757546cff558f9ec2cc29d4165ed8efce49853c815b0622615bc23190694bc

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 ac89a852c2aaa3d389b2d2dd312ad367
SHA1 8f421dd6493c61dbda6b839e2debb7b50a20c930
SHA256 0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45
SHA512 c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 6579c00014a7fdf19ca447c623abcd02
SHA1 ca7ae8d4e8bffbe674e43f99c69f1e0ee33a5b6e
SHA256 eb0c66de126478c961da5e0421775ed89252d7b31e8289cc973c7af75c74064e
SHA512 da8ddbb15701714323bb45820d43267b3c9a875b138b8f6ba6845e7fcb946e8c78001363cfdf1731842e6cc20c0d05788dafc787321c339e94dfaa659fdf1798

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_120148DF360AB0CA4DEE7F56782F4D54

MD5 3823f902540305efc41105899c1e0dc1
SHA1 10a927d26e91caab97aba1447adee2208140b021
SHA256 4380602945f843080a9bba25095077fbbdc030e226998858e360ce204b80836a
SHA512 140a566fccbe042b7461757b41571509dd70619138aec6c3591a29dbddb8c6584f27b6e84d21410ec343d78d3795dcc50b6509374bc7bf6064759acb177250e0

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_120148DF360AB0CA4DEE7F56782F4D54

MD5 ec4dd1ed2f238188592f4027c532a298
SHA1 3dc96c014769bcd277b1e707ae982b604f78e4b6
SHA256 365ec0ac3db882611b9c8432851a2038c3cacdd0e96933d484585ddb3fc2d271
SHA512 23f188adc9687be1ed8dcaa6be3c9da01c099d3af4670c44db62d48bf1ddb42770008e761ff392afc6d1f0a507d77861acb374edff8c5c4e9ca1480811f7e633

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 b2c542623db3756c639ab366384e2365
SHA1 326abe3ee0ccb1b63e37d79f70cd2dd3908b3a7c
SHA256 885595e9830cedaf14908391472d04fc28bdf83b1548b0644ccb7fff5149f4e5
SHA512 010548962033f6dd873840455d96d6879d95d4de501b433d8b3f0bd456b28154e74d986873d89792c0a7dc9427ddd56bbe7431eef1b2fdcf1fa55dd61c7d9f96

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\35DDEDF268117918D1D277A171D8DF7B_C8C5209FBEAFE34DA75A3EABA7859F3D

MD5 63e6a99a95a4bfe9ba2e9948e4383466
SHA1 ae6a5b9001dc1acae6460f36f695aa53ab04fecd
SHA256 455051b64b11ddc7a08a95186684c15a8fac32ac6c637b0c7b2133686e29b1f2
SHA512 ddf8c05522525b624458fd58e1e854c6d6dcde25cbe47fd259883084406d6c36131e48ea8f7bdffb2020f353af87707c539f5616b9ed64d146e8df65d5ff49ab

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\35DDEDF268117918D1D277A171D8DF7B_C8C5209FBEAFE34DA75A3EABA7859F3D

MD5 bf32a827a651630215a5b42148f714ef
SHA1 665e9549ff4fd89b359a21bdb1bae9f0ec12e732
SHA256 ff3ba1d03898f82239f538f1aac2be6f92928479af9f57926954bb3322b704b5
SHA512 a2a0f0d5a76c363791483c11f239b6979cdf86bf43b16efd0392139a25ca8bf7ad0a7c60afc180c72192181926e5d20fd66e1b266171f757217a8a9385b29cb8

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB

MD5 eb41470fdcbf738e843baa5d48899bde
SHA1 318b5185f8317e8bfe9667d441640d7b31eaf0de
SHA256 6ef7c26eba2f3bf56d3d9582ed38f0aec98bb785a6dc4f26f6c829b41c3719b8
SHA512 24ccb7b9f1ce377ac608c528434c57b09d78bf4a9c5abe3533d919c33139486d13f1cdf0a80fa943fb2cc92b4ca174f931c2dec0887546112866f26363ec66a3

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB

MD5 6f19000212315406e66b341f2fe85c1f
SHA1 27470b85ae47600a3b96ac210d76199b644217eb
SHA256 132d876401b9fc79b9e4dfed0c2f1db9c5f2cc3150e0addd6e29616734ef265f
SHA512 90902e9f5a6acf34e4a9cb3fee96d53167ef6015acad5cc69094dab8aba693bd4b995d6496eaec1bb73ac626ed8505ce7ef8eacecaa5908f93f2068aa38bb623

memory/2360-134-0x00000243D94C0000-0x00000243D94C1000-memory.dmp

memory/2360-135-0x00000243D94D0000-0x00000243D94D1000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\ZBRLKSH4\favicon[1].png

MD5 3e764f0f737767b30a692fab1de3ce49
SHA1 58fa0755a8ee455819769ee0e77c23829bf488dd
SHA256 88ae5454a7c32c630703440849d35c58f570d8eecc23c071dbe68d63ce6a40d7
SHA512 2831536a2ca9a2562b7be1053df21c2ed51807c9d332878cf349dc0b718d09eeb587423b488c415672c89e42d98d9a9218face1fcf8e773492535cb5bd67e278

memory/5080-185-0x000002ECFAB00000-0x000002ECFAC00000-memory.dmp

memory/4112-188-0x0000016FD6580000-0x0000016FD6680000-memory.dmp

memory/5080-212-0x000002ECF9750000-0x000002ECF9850000-memory.dmp

memory/5080-223-0x000002ECFA660000-0x000002ECFA680000-memory.dmp

memory/5080-222-0x000002ECFA780000-0x000002ECFA7A0000-memory.dmp

memory/5080-234-0x000002ECF9100000-0x000002ECF9200000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\ZBRLKSH4\4Kv5U5b1o3f[1].png

MD5 a81a5e7f71ae4153e6f888f1c92e5e11
SHA1 39c3945c30abff65b372a7d8c691178ae9d9eee0
SHA256 2bc7a47889c56ad49f1b8b97385d5a4d212e79bb8a9b30df0665a165f58b273e
SHA512 1df32349b33f6a6fcb1f8b6093abd737fa0638cdd6e3fd90a7e1852bd0e40bc2633cb4e13c4824fb948d1e012e5cb9eed0b038b121404865495d4e57e123db69

memory/5080-421-0x000002ECFC610000-0x000002ECFC612000-memory.dmp

memory/5080-423-0x000002ECFC630000-0x000002ECFC632000-memory.dmp

memory/5080-425-0x000002ECFC5E0000-0x000002ECFC5E2000-memory.dmp

memory/5080-427-0x000002ECFC6C0000-0x000002ECFC6C2000-memory.dmp

memory/5080-431-0x000002ECFC6F0000-0x000002ECFC6F2000-memory.dmp

memory/5080-429-0x000002ECFC6E0000-0x000002ECFC6E2000-memory.dmp

memory/5080-435-0x000002ECFCAF0000-0x000002ECFCAF2000-memory.dmp

memory/5080-437-0x000002ECFCBB0000-0x000002ECFCBB2000-memory.dmp

memory/5080-439-0x000002ECFCBD0000-0x000002ECFCBD2000-memory.dmp

memory/5080-433-0x000002ECFCAD0000-0x000002ECFCAD2000-memory.dmp

memory/5080-441-0x000002ECFCBF0000-0x000002ECFCBF2000-memory.dmp

memory/5080-443-0x000002ECFCC10000-0x000002ECFCC12000-memory.dmp

memory/5080-445-0x000002ECFCC30000-0x000002ECFCC32000-memory.dmp

memory/5080-447-0x000002ECFCC40000-0x000002ECFCC42000-memory.dmp

memory/5080-461-0x000002ECFC430000-0x000002ECFC432000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\SPCEXR6J\vXJMBfWazZm[1].css

MD5 dfbcd13219fe8ddc476449b3540f525a
SHA1 f15f973bbc425b3fc183bbd84e667f376025edb6
SHA256 6e537d26302298bfabc69717b2022d178163b9347b17e5f5e2ab4ad4329a807b
SHA512 01da24d10cdafa1de9ec5460a253635ba8d051942b166e7ab6f60790dbfecd46375ef6dea88f709cd016a62beb9ccecaf8afdf458a780ca67fa553110d1c6490

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\AZ38E6E9\NO6v_QoExiU[1].css

MD5 4ad0c204ab96d8b7a00cca29e3b80e47
SHA1 eff157d956dc7e91d71885a02d299385b8fcfe7d
SHA256 c801aaa50d54ffa127a1a0fb6fc7e4b8c09da5c7e499724ac46283d67473bdbf
SHA512 ab31d438b0e05ea53fdd1589127616b816f9c3664de4556344dc60640c21d9c721cc067f6e0b8ead4dd83418b088a0e73c26343ee0f70bd40dfad0e52b3053ce

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\DYBJD6M2\oKWw05XN2vO[1].css

MD5 ec4a282212fba149083e388ab5ea7e7f
SHA1 d47bc0996e934bcbd47ac6fe2decb7599be1ab58
SHA256 3d3943a11c7c7a2f1c198d6cd269b31e598825626f7b75249575d43c5d2ad83c
SHA512 0a5711a354d8263d07cec8c7294600e8ac1ce2ad0e3d022abd5320299010e8a8f8ee07c262c22c907a5a1449ca0e7fd9224fcfc6de19a58bcf4370d8823d8607

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\DYBJD6M2\zwV-QkkKRiB[1].css

MD5 55c0d6fa46d14567a94b8c73b13090c1
SHA1 5da46ed76b12a1ebea41979b5f4a87b2f6ed6f0b
SHA256 9229f5823bb5174461bbc2d8d4edc6f19f63437ebd8148e884894e512c235505
SHA512 77612e79c9a5878d6e332aa5c78a710874a22b2c464cb6220f8a260b7f0c83cb66eb438b127f32f81056cbd950eedee91f6f85c7a1195900e41e6aa1b43860b0

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\DYBJD6M2\4GtXf5LES9v[1].css

MD5 f8490101397ccf93f26567687b895511
SHA1 d5ad6acae53fe4488c835e85e8f0103d9b9221d1
SHA256 668d50ee20bea7758f95d690fd4e5bcad8a9811d451e0d3cc179d3b48cfb4514
SHA512 b8e5b0b5b4be936bc346bf6b6b4e0758edbc3bd1d3c5869432175939d7bf8f71f96262bb2c0527f47057462e92e158c0903b8c807b19f44aa2adfeb8d0ba5f36

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\DWEX47OV\i6g9cqwYkit[1].js

MD5 bf3cdaa229a4b6fac55ef9baba01f450
SHA1 b1ebe361106d271e19462dcc8e09ca6a9bb3685c
SHA256 f2f13b135ffca8c5d7baa3880f94105eafa25c559161f2db72032a21104f50ad
SHA512 4950f8c2667a64a4b87be938e4673d662f76ff38617e8ce627126bcb15820a16d70e051c0d4c53cbdae1d9a8883cf6bf3a348da77b23181d1d93e230cd17e3ae

memory/4260-471-0x000001C24FB10000-0x000001C24FC10000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\SPCEXR6J\4lCu2zih0ca[1].svg

MD5 ecd94021d2c853c3b8deb8203ba17300
SHA1 6f0e24baf66ae386041e8faf42363418a4c96144
SHA256 0d6f8d206a6bd8b60a2048a3df206ac956a2f633786e4af1c02057f81758ad7a
SHA512 1967613484eb4fb2a50628cced684c3e1022d1df51d5aa86ade53828dbdf0a748a8e99669c08ec5a9aa4ba97dc74f709ad4798bf486c1baeec60d24b223e5d50

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\DWEX47OV\oC3HcWDoaa8[1].js

MD5 caf7015c75a5774faa46e3c8db7a6e00
SHA1 1f82ed52c78c2f33bd90531e41e2dec4cf4434b6
SHA256 aa2836204956eeac765606ff285dc62dee621c6079d80ca971ba85fed5853adc
SHA512 04118d89e638c517c46cd021d717d818e9d566e14b73be7c839aad0f12e3a4b647e89b0fcefefa14ffa1db33d357e7d20ceae64f52468532e911a2c72cc78048

memory/4260-526-0x000001C260A60000-0x000001C260A80000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\AZ38E6E9\p55HfXW__mM[1].js

MD5 759df6e181340ef0a76a1bab457ebb22
SHA1 2afdfa1808428e97f7f8faea0624c8402956b04e
SHA256 9e57fedb96b3686621bccd5521f43a2037a823c74f062176952890b179b3955b
SHA512 2e20c1b3b445dd0b143dc636eac9421454b1615a6ce0be63afa012e7571385f346f456b9ff25545fd90ae11dd08b23f03f36f2242c817855d26578fc9f5c94ba

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\AZ38E6E9\x1DUOA-7LK2[1].js

MD5 192197b1129221a1a0707a2a9ff0e12c
SHA1 e768527c3e84a5d97ea32b7eaa4bded3650d5bca
SHA256 ffa86714b465e7ca971140b5b03eff5fdd7d427bcd8bbd4a6fcc1f2faa6acd1c
SHA512 6b0e09732a609af726f5ef69fda51c66d8677626c54d716ed1c48322d979ecb68201f7f775e1cff28329a5f5a2707f42b9a82fa4886ffb86a1b7e3204a2d80ce

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\SPCEXR6J\7Bdh1Inft9L[1].js

MD5 c709b1fe6081920a579faa6b1c3b5578
SHA1 c12605793ee2ad274e336cd2c311a70642635a1a
SHA256 46a2618204a711de421e5c1a13e5cb91e82acb860b6ca6774d0d4f6889b33410
SHA512 860ea9d211c0247ff2a9342052073bc94e41373da63e93264ae514a3b94431a70df1361dfb2b29232ab557a0620cc12244e7864218696cf0637ea6dbf017f49b

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\SPCEXR6J\afZz5t3PLXj[1].js

MD5 f345e0f404dc5d3ef6e01aa7e9bc24e6
SHA1 a22f0b0218dcc907f829d18fdc75ff9d64631f39
SHA256 fd1f8b295e54e7dc299f7f090bf195688093ecca79add55075f6f03b735b2ec4
SHA512 9e5355f48ccb9a12b2d2f927ebc0a24215ddd809ee1be34b0b6d3599dd5b73e866afcab2f9bb99da115309f478e9d594fa13950cb3b3098c1fbf591ec7b02e5c

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\DWEX47OV\rEjaa7z8gcr[1].js

MD5 9fb81471a9d6ced265032b731a0353c0
SHA1 5fbe0642cab2bb8169ceb7f5fbd7fe953c11c7c0
SHA256 9babcdd7932ecec09cb76a7e4561e896718101263efb8930ab3227f8826da9bb
SHA512 7ef0a01e25b957e4580752b1085e8c14b50ed922a6553b0ebdb038f847bb581b08ad2b942d851cc80d2f8f6d3f5075560e15780845eaa17fcb0d3a29e9528ee2

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\AZ38E6E9\cZdqxLwtg7K[1].js

MD5 da7fa8cbad2daa08a990ac7d8f661c37
SHA1 727a14a7264557cecfe6a975d66bb3f80eb6ca21
SHA256 32ecaac6ab1e1d19519c8ceaa631aff4710f68b40eafb86cc939c13a20460d32
SHA512 092691d77c371e34e7e92e4aacba49d01d2910fd071a2c5edecc6509d813a08beda184b56aaf3637d517a2c5aeb3ea6efe5f695238df4d1e5661213a63f6b41e

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\47LW42UO\m.facebook[1].xml

MD5 c1ddea3ef6bbef3e7060a1a9ad89e4c5
SHA1 35e3224fcbd3e1af306f2b6a2c6bbea9b0867966
SHA256 b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db
SHA512 6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\DYBJD6M2\cookie_info_card_image_2[1].png

MD5 c1164ab65ff7e42adb16975e59216b06
SHA1 ac7204effb50d0b350b1e362778460515f113ecc
SHA256 d7928d8f5536d503eb37c541b5ce813941694b71b0eb550250c7e4cbcb1babbb
SHA512 1f84a9d9d51ac92e8fb66b54d103986e5c8a1ca03f52a7d8cdf21b77eb9f466568b33821530e80366ce95900b20816e14a767b73043a0019de4a2f1a4ffd1509

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\DYBJD6M2\cookie_info_card_image_3[1].png

MD5 b63bcace3731e74f6c45002db72b2683
SHA1 99898168473775a18170adad4d313082da090976
SHA256 ea3a8425dcf06dbc9c9be0ccd2eb6381507dd5ac45e2a685b3a9b1b5d289d085
SHA512 d62d4dddb7ec61ef82d84f93f6303001ba78d16fd727090c9d8326a86ab270f926b338c8164c2721569485663da88b850c3a6452ccb8b3650c6fa5ce1ce0f140

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\DYBJD6M2\cookie_info_popup_image_2[1].png

MD5 beafc7738da2d4d503d2b7bdb5b5ee9b
SHA1 a4fd5eb4624236bc1a482d1b2e25b0f65e1cc0e0
SHA256 bb77e10b27807cbec9a9f7a4aeefaa41d66a4360ed33e55450aaf7a47f0da4b4
SHA512 a0b7cf6df6e8cc2b11e05099253c07042ac474638cc9e7fb0a6816e70f43e400e356d41bde995dce7ff11da65f75e7dc7a7f8593c6b031a0aa17b7181f51312f

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\DWEX47OV\cookie_info_popup_image_1[1].png

MD5 55abcc758ea44e30cc6bf29a8e961169
SHA1 3b3717aeebb58d07f553c1813635eadb11fda264
SHA256 dada70d2614b10f6666b149d2864fdcf8f944bf748dcf79b2fe6dad73e4ef7b6
SHA512 12e2405f5412c427bee4edd9543f4ea40502eaace30b24fe1ae629895b787ea5a959903a2e32abe341cd8136033a61b802b57fe862efba5f5a1b167176dd2454

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\DWEX47OV\cookie_info_popup_image_4[1].png

MD5 01ef159c14690afd71c42942a75d5b2d
SHA1 a38b58196f3e8c111065deb17420a06b8ff8e70f
SHA256 118d6f295fd05bc547835ba1c4360250e97677c0419c03928fd611f4f3e3104b
SHA512 12292194bb089f50bb73507d4324ea691cc853a6e7b8d637c231fadb4f465246b97fd3684162467989b1c3c46eabb3595adb0350c6cf41921213620d0cff455b

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\DWEX47OV\cookie_info_popup_image_3[1].png

MD5 621714e5257f6d356c5926b13b8c2018
SHA1 95fbe9dcf1ae01e969d3178e2efd6df377f5f455
SHA256 b6c5da3bf2ae9801a3c1c61328d54f9d3889dcea4049851b4ed4a2ff9ba16800
SHA512 b39ea7c8b6bb14a5a86d121c9afc4e2fc1b46a8f8c8a8ddacfa53996c0c94f39d436479d923bf3da45f04431d93d8b0908c50d586181326f68e7675c530218ed

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\DWEX47OV\cookie_info_card_image_4[1].png

MD5 9978db669e49523b7adb3af80d561b1b
SHA1 7eb15d01e2afd057188741fad9ea1719bccc01ea
SHA256 4e57f4cf302186300f95c74144cbca9eb756c0a8313ebf32f8aba5c279dd059c
SHA512 04b216bd907c70ee2b96e513f7de56481388b577e6ccd67145a48178a605581fab715096cfb75d1bb336e6ad0060701d2a3680e9f38fe31e1573d5965f1e380a

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\DYBJD6M2\cookie_info_card_image_1[1].png

MD5 3669e98b2ae9734d101d572190d0c90d
SHA1 5e36898bebc6b11d8e985173fd8b401dc1820852
SHA256 7061caa61b21e5e5c1419ae0dc8299142ba89c8169a2bd968b6de34a564f888a
SHA512 0c5f0190b0df4939c2555ec7053a24f5dae388a0936140d68ed720a70542b40aaf65c882f43eb1878704bea3bd18934de4b1aac57a92f89bbb4c67a51b983ae3

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\DWEX47OV\wBOTAcz74c1[1].js

MD5 6e88a63faabf768d7a19004509085f0a
SHA1 de122ee1bea4064da69ae72b22be00b4df2fe33c
SHA256 d3cb628439258ba28d6712d56fb46d5122f7f8e627e9da7461435723293585b7
SHA512 5433f72448dbc6367519ae88d60b2f48a200481da72be02754f4f0d98b2fb0121c39b431741afe300e55ca58d70fc3c33f771f46290a86bba1cbe1ec108ec0a5

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\DWEX47OV\9J7aHdMMGC7[1].js

MD5 255cb5ecdd0482d39db8820174e0d25a
SHA1 974c85e567d6a725070c7ccb84c7e4193b5b735a
SHA256 9dfaada90fa542efa495fc74639dc3833966c99b4ab493015ac83567355530ba
SHA512 7330880b8239d3d0e614862ec0d924178fcdc38534ab89c32bf18bc23d387802320e127cce3a47cf4d63c9b95393cb1770370f6bdb648f20676a0f8e0ee8d2a9

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\SPCEXR6J\ui2DkP-wt_7[1].js

MD5 fb4650e82a5a32490f5b1d4b85594cd7
SHA1 ecced02fa31fa36fd1cfa9b4c52200ef726ee357
SHA256 5fb29c66a3eda461a11e8dae54fcff64e73c23d6b67a5232fc23f417719d8ebb
SHA512 e0e901b61153cc5fe8c8d216c391bfc78fe72e993f55098efebe7e4315f22c722d0e1d617f3a6b682092dfb41a91280963502f4096386eea18ebf3fdf722ef87

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\SPCEXR6J\YRQh-cb5Ugw[1].js

MD5 092ee6a3f25d5ce6f51d548d67586de3
SHA1 f9195bc2bf28850ce5065d0a4ae2c4ee9cd937a4
SHA256 dc5737fc907b2998b4559b5d1673798dd9bafbb9927738989f8d92351e916a22
SHA512 385f776fe9d364cac468146e0d8dda14cb268caaa28be4ba2f6f280292267ce81bcc35e40ff6708d56aa08ab0ccd5f8d751ab65f48162b8d235d2204496e387b

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\AZ38E6E9\ie38mp0O07P[1].js

MD5 d03405286255f92c495fb7cbeb7c9556
SHA1 0fad02cc6fcfca74b57a1db092b5c16e4e9c0759
SHA256 a87feaf65170ded496c597c1f1011a79c39a309e415802b49a3fea32f32dfdb8
SHA512 a4e02f50a12937e9e9ac196c9cef0c73081118556d69cd33d6ffcac820da762e5db82b5ad680ee10687fddb40f6e2ff6ed2034361d53066683c396b12e8f3677

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\DWEX47OV\L6POxMNfoQb[1].js

MD5 b43ff96ee701ea666f95a09c5eb1ba71
SHA1 4f6e0bce92e0b8675126d69d65b1e2a7687ba318
SHA256 9fa780220eb245367f4b4b543441045ef815ed653d6c53c0ee8c29074829060b
SHA512 1115d9352d6b24db9ebacb36afba57f98de21285b8b083043c983daf978162b4a20efb02bb3f20627c1a913c36829aaf032890ed07e29525c4c6304fa7570f6b

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\AZ38E6E9\UAbk1T_NNJ6[1].js

MD5 d850f8384ed71be79cea3790810455e4
SHA1 5e5abfcb0eb0c9bfda62bd4d43881066e9a73aa9
SHA256 5d11aefef80605ab7f73977e5861f928b38627da970e67210d5b7ea2a8144f4c
SHA512 dd1eda6e1bceb306bd44769a4d472aff9b778719170a34b548463fca903841f9a711354e58023ec40f86b09b9a3d21285ad3b800f135a7b8b3313f2e05940121

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\AZ38E6E9\jUmIgM2f5yV[1].js

MD5 ee7423e2b8dacf28a127c8ad7b7f9ee3
SHA1 c907de2b7a818417d892fabcd5dca43e9c45b602
SHA256 35640edf5c4fbca1664e97369e8ee5710ad5da162a04061d9eb890839c7700c5
SHA512 317b21aadbffc2c6ebc1774a0ddb47005e070a7ed9647997fe2b6f692031fee433169d60d5e8fbefd548708f5a34605a612919b83d973f6b464212a82264df5f

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\SPCEXR6J\RzMZ4PnOCXx[1].js

MD5 04f91dd5cd38abcb56956547d5248d88
SHA1 701517976cf6ec7a345e3566ce3e0435e386d169
SHA256 1531348ecef68558f9688fc4fe03cc9b535edbc9d31a82d9cef0efeb95c53a25
SHA512 fa8e109117e2a7dfd03fa119621dee7b89eb26664bd6c01bc3fa0eb396bf08516b85aaf2d60fba458ce1565576d94d0ea64a663900becbe2fb01b63fe20c7d9c

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\AZ38E6E9\J5WesB5J8X3[1].js

MD5 b22b5d3fb83a8bd5f29655cbf0bc3e8b
SHA1 98e0d3bcda68838fd2949f9475078aa6e7529d02
SHA256 7c2bd9123ff50cd9801f9177bf3511ee4d9be97bb091d1b850e8237c9223bd5e
SHA512 3f334f1291eac95c05183ffaed8ca79cd7713b5583b459f53ac7c95b2941beb8cb8acb647fc57fcc807391c6cc294cbb98c8d8fdcc1d14ba6f80fbedbb0bd7dd

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\SPCEXR6J\RTGibnBoJ89[1].js

MD5 73b53548da9c2348fee61cf97ec499d1
SHA1 2e3d6d056d88bf108d26826b262310329bd534fd
SHA256 58d767d68fbda781ae5e53e9f376b0248ba4c6499bd6ebc12b675a1a8c143d88
SHA512 ed757d5c9339ef8d80734435d6262686a66c2fe24a90cdaddcb004b77d82ee2b3b0d609674cf3d753b779726ad31a537bbc0519771145ca617d1dd617d450561

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\DYBJD6M2\WeajZf_EolU[1].js

MD5 3608e76fbda351addb0e78eeaa73afd1
SHA1 31655b8076affd1a292a133392f353a3edac2bdb
SHA256 651a7cadceafb12df8e6d5b923f1df00d33b632b1e4bd9bd3f1c01a92450b4f7
SHA512 5e99bace7ebdc97ac89c92ddbc8d608737f11646eabaafbe70520b6f5a1eae421508465f4f2a6c17840cf8a30b21778819e907beb8717d7292a506f99384a7cf

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\SPCEXR6J\f7nLm-iG8Va[1].png

MD5 47045538aff62f92f1e6bf92ed05fc18
SHA1 982421779c227ac6c2350aae50d98a26b4359465
SHA256 c18bac38866a57c6d60a6227ce166c7d0a91cac951384420c5c8c4029a1511bf
SHA512 4b5b30c1db6e9dc296da1e7902eb14c5c875f961f75a2e0bbe80147b8df74da64f7cd58a84f8871eb371b531dac9f9f2803e106a5aa5cb6d7fd39cb4b1c72d9c

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\AZ38E6E9\ZXwOcP9E7mM[1].png

MD5 7c62e63d62777b5e3538eb60d53228ac
SHA1 272cfde754d30564dfb5195964a05f724dfef761
SHA256 db0b8be4e98758c69a9623a8a5d13930c7edcb02c3bc07f3f58294b221f9e7f9
SHA512 2dafa3fe02a3473bc0dcf8ac81f6def9c3eec962ddd459f1ba550b8891b3ffafb339f347ee21f8fa113c2e05795b929723b60b42beef7a14dd66a51e40ab8f21

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\DYBJD6M2\_tJ17sGyxOX[1].js

MD5 73111912f4b4f7a5b5501dc74d50025b
SHA1 94bae7be09cae37c16321425b151eb0de4592f0d
SHA256 ab6777f622dce53efa7d6a93432292afba7757445eb4cc111b25810882375b98
SHA512 db7a6bf34bd0e3c739917ead6bc24d31b63420498476756e99aab232f7d14a9d0a86dd90764440089b66b2d544a327884f17b566dd02eb783360da749789b738

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\DWEX47OV\yQ3zakGXp7g[1].js

MD5 f4ff389c7b3d7f0ca4c26dd3445cf390
SHA1 fe2bbf6acdab381a7dd0f684c24831cf2b509021
SHA256 341b475aa2990f511b6598bf4de4e49102e9b911998cde7587b84b9d5444f36e
SHA512 e5cd06d969cba1c953f619412504273555a5f94861c346f40a2039d57a38e1d7df845008d7b1aa01a28cba8349bc3e8db4a192d80cc20616daf2e4554c3de710

memory/4260-614-0x000001C260210000-0x000001C260230000-memory.dmp

memory/5080-691-0x000002ECF8E30000-0x000002ECF8E40000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\E49JWOHD\edgecompatviewlist[1].xml

MD5 d4fc49dc14f63895d997fa4940f24378
SHA1 3efb1437a7c5e46034147cbbc8db017c69d02c31
SHA256 853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1
SHA512 cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DFF3A84732DB9F6219.TMP

MD5 fd94ef4b9a101074d006b0281dab5ca4
SHA1 4f0aea4741717afd39e55b851801081de2e03448
SHA256 f26d632a0ff07700b078f95590c9efee9426b1cd4f39377f52faed055d508b00
SHA512 a254cdf6a76fb689a3ebf07b6d5bb5e93a50b8d72c0aad5d5b0f55af0530f079243e3c01813877596227cb38c5dc9a85f8fda2cce70da0fe532f9645cff73d9d

C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\6KTCIBYQ\suggestions[1].en-US

MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee