hxxps://megawrzuta[.]pl/download/a37d5e686e4f49742da6a1037228b741[.]html

Resubmissions

23-07-2024 13:34

240723-qvfksswama 4

23-07-2024 12:41

240723-pw1rpazflp 10

Analysis

max time kernel
149s
max time network
143s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
23-07-2024 13:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://megawrzuta.pl/download/a37d5e686e4f49742da6a1037228b741.html

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = d1e8c62a05ddda01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaVR = "1"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaVR = "6;18;22"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\doubleclick.net\Total = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\megawrzuta.pl\Total = "1577"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaVR = "{14E74C62-DC97-43B0-8F2F-581496A65D60}"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaVR = "{37A9D401-0BF5-4366-9530-C75C6DC23EC9}"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState\EdpState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\megawrzuta.pl\ = "0"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaVR = "436;41c;401;801;c01;1001;1401;1801;1c01;2001;2401;2801;2c01;3001;3401;3801;3c01;4001;42b;42c;82c;42d;423;402;455;403;c04;1004;1404;41a;405;406;465;413;813;809;c09;1009;1409;1809;1c09;2009;2409;2809;2c09;3009;3409;425;438;429;40b;80c;c0c;100c;140c;180c;456;437;807;c07;1007;1407;408;447;40d;439;40e;40f;421;410;810;44b;457;412;812;440;426;427;827;42f;43e;83e;44e;450;414;814;415;416;816;446;418;419;44f;c1a;81a;41b;424;80a;100a;140a;180a;1c0a;200a;240a;280a;2c0a;300a;340a;380a;3c0a;400a;440a;480a;4c0a;500a;430;441;41d;81d;45a;449;444;44a;41e;41f;422;420;820;443;843;42a;540a"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaVR = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\CortanaVoices\\Tokens\\MSTTS_V110_enUS_EvaM"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaVR = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\en-US\\VoiceActivation_en-US.dat"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = 010000000d8b0c6e9d7117acf7b9e18af6ecb182e52fe48121d3d4a662a51c0d9efae764f596cd5fe6edb5411965e1573df9cd7c3903b34f81ecbc5d3829	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\googleads.g.doubleclick.net	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaVR = "11.0"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaVR = "HW"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$MediaWiki	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\doubleclick.net\ = "0"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaVR = "SpeechUXPlugin"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaVR = "{06405088-BC01-4E08-B392-5303E75090C8}"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaVR = "%windir%\\Speech_OneCore\\Engines\\SR\\en-US-N\\tn1033.bin"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaVR = "Microsoft David Mobile - English (United States)"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-087602 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState\EdpCleanupState = "0"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaVR = "11.0.2016.0129"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$http://www.typepad.com/	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage\ProcessingFlag = d0d9924f05ddda01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\megawrzuta.pl\ = "1661"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\megawrzuta.pl\ = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "395205405"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "1577"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "1661"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaVR = "Adult"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "1711"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\FileVersion = "2016061511"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B72164 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\megawrzuta.pl\Total = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\doubleclick.net	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaVR = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\Voices\\Tokens\\MSTTS_V110_enUS_DavidM"	MicrosoftEdgeCP.exe

Suspicious behavior: MapViewOfSection 11 IoCs

pid	Process
4192	MicrosoftEdgeCP.exe
4192	MicrosoftEdgeCP.exe
4192	MicrosoftEdgeCP.exe
4192	MicrosoftEdgeCP.exe
4192	MicrosoftEdgeCP.exe
4192	MicrosoftEdgeCP.exe
4192	MicrosoftEdgeCP.exe
4192	MicrosoftEdgeCP.exe
4192	MicrosoftEdgeCP.exe
4192	MicrosoftEdgeCP.exe
4192	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3100	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3100	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3100	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3100	MicrosoftEdgeCP.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4316	MicrosoftEdge.exe
4192	MicrosoftEdgeCP.exe
3100	MicrosoftEdgeCP.exe
4192	MicrosoftEdgeCP.exe
2676	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77
PID 4192 wrote to memory of 4688	4192	MicrosoftEdgeCP.exe	77

C:\Windows\system32\LaunchWinApp.exe
"C:\Windows\system32\LaunchWinApp.exe" "https://megawrzuta.pl/download/a37d5e686e4f49742da6a1037228b741.html"
1⤵
PID:4440

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4316

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4556

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4192

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3100

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4688

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:2820

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
4KB

MD5
1bfe591a4fe3d91b03cdf26eaacd8f89

SHA1
719c37c320f518ac168c86723724891950911cea

SHA256
9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8

SHA512
02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\XCFODRP5\edgecompatviewlist[1].xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\2B99VLKI\css[2].css

Filesize
555B

MD5
4d79840adecbd4c6b2212f255bf49ec9

SHA1
ba28dd0b0feeae61f5f8a4640a4aa2e5671130b7

SHA256
f1d7f8fd1c5cdb5b783340c691e8e6b4051781260211288f91db6355dabdf5e4

SHA512
60827e4c6c7c397ccc2b70a9f3e98ca042d4f3ef693831895c27291ed5fe24b6b01c6d64519b630cb515aadf906f5a31e91ece497aa410e11a7334935c3828f3

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\2B99VLKI\f[2].txt

Filesize
2KB

MD5
98408a561a774e2414e19971eec1f993

SHA1
f51216ceb3dc42de1416511664a7ab3bf7ef6b55

SHA256
bc7ef6c5abc6ad9f53e4b766c83bd5f57fce9d43db9cca546b1187e4a0583ef1

SHA512
a81646843f0d44a52db9e04debcd5262d8892827aa0608fa3a9284f3963e9177cbf3ae99538c28692dcfa78ed6240ace96486e9e6eab6562a6b8d9e1b545f844

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\3SVWFFP3\188a63c500db6a3aa7c42aa7d4186e28[1].js

Filesize
54KB

MD5
188a63c500db6a3aa7c42aa7d4186e28

SHA1
0aab0267dd472e84dd91cf805d718c9c35921a74

SHA256
85d5c08068dbf64b26a69d69df540b27530e45e664967b97f0e008797bbf4fee

SHA512
e6c64dadcab418424b562e3862547981ea4291d89b62d1407e5d60db3557d41083c351604c55212e6d3141c4c2f4055c989c8a98f635aa5ca01672c750166da8

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\3SVWFFP3\analytics[1].js

Filesize
51KB

MD5
575b5480531da4d14e7453e2016fe0bc

SHA1
e5c5f3134fe29e60b591c87ea85951f0aea36ee1

SHA256
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

SHA512
174e48f4fb2a7e7a0be1e16564f9ed2d0bbcc8b4af18cb89ad49cf42b1c3894c8f8e29ce673bc5d9bc8552f88d1d47294ee0e216402566a3f446f04aca24857a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\3SVWFFP3\f[1].txt

Filesize
203KB

MD5
1340dab71f976c4daebf4d7381424408

SHA1
06adb7052b21f28d9cb45a7ce1907709a634fe05

SHA256
189ce08b2ed335660e1e5ff3ae23b46a571cb037605ad62e67c081a5bd4a6bd2

SHA512
82501b4317d12820546371eec72f170db3cdb3f039e091127511774c1bcc70fd22719ecadd84606cd874e253aa93468154a3b43890e0f13f756b82f614a14e19

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\3SVWFFP3\f[2].txt

Filesize
30KB

MD5
e803a6f084380b14ac0c360db0e9756e

SHA1
ead20177192b75880234eda2b46c281b5a7e3554

SHA256
a078ea5f482f85fc13eaa1e019c324687ad7ca09fb8ca059de1ca7c23ebba101

SHA512
096267de547cfddad54692ca569326cc26e708dcd4dafc37dcae660ce3fc819513bc2a29f1e0719c93a4143b7ccc95d79f25ca57afccb1287be8765cb09ff2b4

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\HY0TTRD4\5V18NYvu480-MhEwM9GnRWI4eEDE4R9vNdKnUFhfqY0[1].js

Filesize
52KB

MD5
5ffc09acc2fff2c279396ad507801651

SHA1
0b050d752f1d69c5e221475cb850b83911d0d7e8

SHA256
e55d7c358beee3cd3e32113033d1a74562387840c4e11f6f35d2a750585fa98d

SHA512
3e08f28ee409389ee4a40a2d50ce4b617f34d288d24134e059e25b96eaf1938d60177b65db18a192c5c7732aa09556ec5009c961d72875cccd45103002a04f66

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\HY0TTRD4\s[1].htm

Filesize
143B

MD5
e4e31b474d3e0b577b3c8856e91f8659

SHA1
a81311f7fcfa9b6b23a24d4e5c976d5f75b1b9b7

SHA256
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

SHA512
a07961eb39c4cd4e39ee19e2c675e64e5ba5367daa18e2f76a23772abd62f46b002e6be8fb0f35a70616941178facc8df579c4a68e5811b74313c12806aafae3

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\YR4MGQQ5\4Ua_rENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RFD48TE63OOYKtrwEIJllpyk[1].woff2

Filesize
20KB

MD5
1435f3cfd01bf0f3c24b8983e6780db0

SHA1
439ab7ffa6f9d5b654710691d8736eedf2b6e892

SHA256
8cd3f9f312e86bade2e77eb25c28eba805707909441d49e29288944677ce6d47

SHA512
dded0517b2c8f6c6ea045ba87f3ae870df63843291c3e2219e7bdeb4e33baf360b5fdb6065f0566fd1c79253105574ee4ca8cb13a11f7e6a51bf20eacf03155b

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\YR4MGQQ5\f[2].txt

Filesize
2KB

MD5
cc47d2de85d243938c1e5277f7be2cbd

SHA1
df36c30bc0dc38b9aab1a2e9ca9fd12447ea2a74

SHA256
2897afa8893463a77bfde7d06c22334a7c2b4b671d2bbdaafc06396d6d4a50c0

SHA512
bbb56750c63e11583a48e82357bc0a2e95bd92d612d282981216ebb7b453841f272dea552fa963da632ddc1d111494d417801817574972b49c58d70be444baf3

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\YR4MGQQ5\f[3].txt

Filesize
30KB

MD5
149457303277de62bdf691307bb0a07c

SHA1
93937b52ee0ac3a506d781a9fc8986f9ccd24ece

SHA256
cf7bcb00b429fce86082a6d75ee648bda812b18e8a1326cd01b66eac64db41f9

SHA512
5554f874d6c09e8aaf7359356e7694b59aea0d61f9787fa2cca7488090f6b6c91ea91994ffcac23692aa5e1d44483810a827c7b8c139bb664c4810b354244bc0

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\V0ZI55N1\megawrzuta[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\V0ZI55N1\megawrzuta[1].xml

Filesize
2KB

MD5
df6a33aacb3b704d18ab870e6336ca1a

SHA1
52b72b486f650595948cc998871079bfc6149d71

SHA256
c22a95115e994c3597fdbbab4ebc726ad020d78fe8c37ce2b8a64cc088722278

SHA512
17b5d7b478e07776b6e1157db482f67e9abf2e3e4b5fdee71167b451318ef0fa795fa49322b5fdeb3377dd17d9f2c78f7983d98e3858aacb651e883e7c364402

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\3023Z4MR\favicon[1].ico

Filesize
110KB

MD5
1db747255c64a30f9236e9d929e986ca

SHA1
384023452346aa087d40c93c23ca2f5e32ff1b1f

SHA256
88baf40feb43463a8f6aa6543e88bdbe33f0db9a317486e786eee1e5c76a9544

SHA512
05d654610ebf0c5de4ce828923c63e21d3164f4aebcec5db2415be23bd6965a50f5506ec8772c4624fae266944a9cc596947d3c061f0f9602633103238c64267

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\60OWAKUB\android-icon-192x192[1].png

Filesize
11KB

MD5
a9d62d2372b9369db44f0fd9a9eb1365

SHA1
33117c42a3181df3454a699cc6f42b6d9928f5b3

SHA256
5947219bd0979d19b781fa926a72b8c00b64cfe671d76e1412e06d2d4bd82eb8

SHA512
420cb5feed8735dab2f9aa7f0774ddcf341bc74f886d3dd693f04dffde0deda08c61ca551f8a436c8d993b4f5a8adbbf1241746345cdeb60adc4e215feb27466

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\LPFJSD1F\favicon[1].ico

Filesize
758B

MD5
84cc977d0eb148166481b01d8418e375

SHA1
00e2461bcd67d7ba511db230415000aefbd30d2d

SHA256
bbf8da37d92138cc08ffeec8e3379c334988d5ae99f4415579999bfbbb57a66c

SHA512
f47a507077f9173fb07ec200c2677ba5f783d645be100f12efe71f701a74272a98e853c4fab63740d685853935d545730992d0004c9d2fe8e1965445cab509c3

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\Q0HHSSW8\favicon[1].ico

Filesize
10KB

MD5
c97dc60c807d90f0b7f6c38972ec27cb

SHA1
b887e1873305b404207a6bf6a10148d3a85e7dc5

SHA256
05b4565c600ad99af4be76bf57b69fe781d0826932ab44e12fceee8f6058f963

SHA512
b1809cabb8a686eede87b4f63a8f0d612b2e8ec1bf8dd378d6264c089ad300d66b19598ffd40182f98a00b2c4d87ee83df73a3629f7220b7a93901c669cb6f41

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\Q0HHSSW8\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\ImageStore\o75mgme\imagestore.dat

Filesize
143KB

MD5
09f329bf74967ad58e3853a95a1a99ef

SHA1
e30909654c3a6e5cae483dd94ab806910b8edc13

SHA256
631aa4151200e4d5f34158582352b2f7d98250a64f8827e553ad35877942a0be

SHA512
62e26229ce0e59aa295a4a05c7607c469d49fe3a89be349fc4dc672520cf12d6d28bf39b1426a77ae939cfff98fdbe5a95474cae5a59adacf2c0bf8552505f0c

Download Submit
memory/3100-44-0x0000022010600000-0x0000022010700000-memory.dmp

Filesize
1024KB

Download
memory/4316-16-0x000002A3FEA20000-0x000002A3FEA30000-memory.dmp

Filesize
64KB

Download
memory/4316-35-0x000002A3FBDD0000-0x000002A3FBDD2000-memory.dmp

Filesize
8KB

Download
memory/4316-0-0x000002A3FE920000-0x000002A3FE930000-memory.dmp

Filesize
64KB

Download
memory/4688-423-0x000001E8BC090000-0x000001E8BC0A0000-memory.dmp

Filesize
64KB

Download
memory/4688-449-0x000001E8BC090000-0x000001E8BC0A0000-memory.dmp

Filesize
64KB

Download
memory/4688-446-0x000001E8BC090000-0x000001E8BC0A0000-memory.dmp

Filesize
64KB

Download
memory/4688-445-0x000001E8BC090000-0x000001E8BC0A0000-memory.dmp

Filesize
64KB

Download
memory/4688-444-0x000001E8BC090000-0x000001E8BC0A0000-memory.dmp

Filesize
64KB

Download
memory/4688-443-0x000001E8BC090000-0x000001E8BC0A0000-memory.dmp

Filesize
64KB

Download
memory/4688-442-0x000001E8BC090000-0x000001E8BC0A0000-memory.dmp

Filesize
64KB

Download
memory/4688-451-0x000001E8BC090000-0x000001E8BC0A0000-memory.dmp

Filesize
64KB

Download
memory/4688-452-0x000001E8BC090000-0x000001E8BC0A0000-memory.dmp

Filesize
64KB

Download
memory/4688-453-0x000001E8BC090000-0x000001E8BC0A0000-memory.dmp

Filesize
64KB

Download
memory/4688-454-0x000001E8BC090000-0x000001E8BC0A0000-memory.dmp

Filesize
64KB

Download
memory/4688-455-0x000001E8BC090000-0x000001E8BC0A0000-memory.dmp

Filesize
64KB

Download
memory/4688-456-0x000001E8BC090000-0x000001E8BC0A0000-memory.dmp

Filesize
64KB

Download
memory/4688-450-0x000001E8BC090000-0x000001E8BC0A0000-memory.dmp

Filesize
64KB

Download
memory/4688-447-0x000001E8BC090000-0x000001E8BC0A0000-memory.dmp

Filesize
64KB

Download
memory/4688-448-0x000001E8BC090000-0x000001E8BC0A0000-memory.dmp

Filesize
64KB

Download
memory/4688-439-0x000001E8BC090000-0x000001E8BC0A0000-memory.dmp

Filesize
64KB

Download
memory/4688-440-0x000001E8BC090000-0x000001E8BC0A0000-memory.dmp

Filesize
64KB

Download
memory/4688-441-0x000001E8BC090000-0x000001E8BC0A0000-memory.dmp

Filesize
64KB

Download
memory/4688-405-0x000001E8CDA60000-0x000001E8CDA62000-memory.dmp

Filesize
8KB

Download
memory/4688-366-0x000001E8CDB60000-0x000001E8CDB80000-memory.dmp

Filesize
128KB

Download
memory/4688-256-0x000001E8CFFB0000-0x000001E8CFFB2000-memory.dmp

Filesize
8KB

Download
memory/4688-253-0x000001E8CFF50000-0x000001E8CFF52000-memory.dmp

Filesize
8KB

Download
memory/4688-250-0x000001E8CFF60000-0x000001E8CFF62000-memory.dmp

Filesize
8KB

Download
memory/4688-247-0x000001E8CE2F0000-0x000001E8CE2F2000-memory.dmp

Filesize
8KB

Download
memory/4688-234-0x000001E8CDFA0000-0x000001E8CDFA2000-memory.dmp

Filesize
8KB

Download
memory/4688-236-0x000001E8CE2D0000-0x000001E8CE2D2000-memory.dmp

Filesize
8KB

Download
memory/4688-59-0x000001E8BC800000-0x000001E8BC900000-memory.dmp

Filesize
1024KB

Download