hxxps://www[.]unknowncheats[.]me/forum/downloads[.]php?do=file&id=42362

Analysis

max time kernel
142s
max time network
299s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
05/08/2024, 20:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.unknowncheats.me/forum/downloads.php?do=file&id=42362

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "2032"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "690"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingDelete\C:\Users\Admin\AppData\Local\Packa = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "1939"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = d2b2c34574e7da01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\unknowncheats.me\NumberOfS = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\Total = "3511"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\NumberOfSubdomains = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com\ = "3511"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "1835"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = c9dc8c4574e7da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "233"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.unknowncheats.me\ = "1848"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.unknowncheats.me\ = "2061"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 99e25b6074e7da01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "704"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.unknowncheats.me	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{2D03FB70-299F-4CC0-9E1E-8D7870C74A5D} = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "395205405"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\NextPromptBuild = "15063"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com\ = "5439"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\unknowncheats.me\ = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\unknowncheats.me\Total = "1835"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\unknowncheats.me	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "2099"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\ = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.unknowncheats.me\ = "1261"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DomStorageState	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\OneTimeCleanup = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "124"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 069f4a4874e7da01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\Total = "603"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\www.bing.com	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
3828	MicrosoftEdgeCP.exe
3828	MicrosoftEdgeCP.exe
3828	MicrosoftEdgeCP.exe
3828	MicrosoftEdgeCP.exe
3828	MicrosoftEdgeCP.exe
3828	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	516	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	516	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	516	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	516	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4340	MicrosoftEdge.exe
Token: SeDebugPrivilege	4340	MicrosoftEdge.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4340	MicrosoftEdge.exe
3828	MicrosoftEdgeCP.exe
516	MicrosoftEdgeCP.exe
3828	MicrosoftEdgeCP.exe
4236	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 3828 wrote to memory of 984	3828	MicrosoftEdgeCP.exe	77
PID 3828 wrote to memory of 984	3828	MicrosoftEdgeCP.exe	77
PID 3828 wrote to memory of 984	3828	MicrosoftEdgeCP.exe	77
PID 3828 wrote to memory of 984	3828	MicrosoftEdgeCP.exe	77
PID 3828 wrote to memory of 984	3828	MicrosoftEdgeCP.exe	77
PID 3828 wrote to memory of 984	3828	MicrosoftEdgeCP.exe	77
PID 3828 wrote to memory of 984	3828	MicrosoftEdgeCP.exe	77
PID 3828 wrote to memory of 984	3828	MicrosoftEdgeCP.exe	77
PID 3828 wrote to memory of 984	3828	MicrosoftEdgeCP.exe	77
PID 3828 wrote to memory of 984	3828	MicrosoftEdgeCP.exe	77
PID 3828 wrote to memory of 984	3828	MicrosoftEdgeCP.exe	77
PID 3828 wrote to memory of 984	3828	MicrosoftEdgeCP.exe	77
PID 3828 wrote to memory of 984	3828	MicrosoftEdgeCP.exe	77
PID 3828 wrote to memory of 984	3828	MicrosoftEdgeCP.exe	77
PID 3828 wrote to memory of 984	3828	MicrosoftEdgeCP.exe	77
PID 3828 wrote to memory of 984	3828	MicrosoftEdgeCP.exe	77
PID 3828 wrote to memory of 984	3828	MicrosoftEdgeCP.exe	77
PID 3828 wrote to memory of 984	3828	MicrosoftEdgeCP.exe	77
PID 3828 wrote to memory of 984	3828	MicrosoftEdgeCP.exe	77
PID 3828 wrote to memory of 984	3828	MicrosoftEdgeCP.exe	77
PID 3828 wrote to memory of 984	3828	MicrosoftEdgeCP.exe	77
PID 3828 wrote to memory of 984	3828	MicrosoftEdgeCP.exe	77
PID 3828 wrote to memory of 984	3828	MicrosoftEdgeCP.exe	77
PID 3828 wrote to memory of 984	3828	MicrosoftEdgeCP.exe	77
PID 3828 wrote to memory of 984	3828	MicrosoftEdgeCP.exe	77
PID 3828 wrote to memory of 984	3828	MicrosoftEdgeCP.exe	77
PID 3828 wrote to memory of 984	3828	MicrosoftEdgeCP.exe	77
PID 3828 wrote to memory of 984	3828	MicrosoftEdgeCP.exe	77

C:\Windows\system32\LaunchWinApp.exe
"C:\Windows\system32\LaunchWinApp.exe" "https://www.unknowncheats.me/forum/downloads.php?do=file&id=42362"
1⤵
PID:688

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4340

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4816

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3828

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:516

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:984

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\MicrosoftEdge\SharedCacheContainers\MicrosoftEdge_iecompat\IECompatData.xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\K3QN37R0\advally-5.40.0[1].js

Filesize
115KB

MD5
d88d7d6856305b8e33aae901a91da21d

SHA1
a5482db6edeed7f353cdfeb19644e9526a07a8af

SHA256
19ef787747cf103c0a91a08a330748dc94c005467e87ce73d3deb4ac9f04394a

SHA512
9fb4f210b03f0b2e6d85ff244f228beff8e58768a9fc300bd6de74f50a9638c8c37114808d3ed1bbb485dd51e1bfb57f7c379e7885cdcb0779a496f45b0cf7d4

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\K3QN37R0\cmp2-polyfilled[1].js

Filesize
503KB

MD5
5a82e817f2dca62294829277a2d92e5a

SHA1
826af2f21e521d53706e99f9f15215823f560581

SHA256
49471d72acf15795455d47906aaa78a67ce2d3ef17cebf0c7ac23d5c85014d51

SHA512
fb2be47e1dd41912a481bf172a11d35ec5a1691c22726caa48d11dec124258a8b5ec5f420edf266511f9c9ed6d3ceff9519a28cabd67b18267005eb601dc7e70

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\K3QN37R0\f[1].txt

Filesize
472KB

MD5
b0332a3fdeebf237406a9492657cf3cc

SHA1
35d5c5f4a6f4e525acdc5e0fc42fd165a00bedc7

SHA256
612b2f37cd260cc286f109fed7a48e61d145a494834e3a34216006cea4e84794

SHA512
c37572950ef3a589495d774b30d3415c7a80b0af55d9b4e4552efad1c594b6f8df10daab9a37061df7d316772114d3123f9476197118013e7b21ed45171fe1e9

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\K3QN37R0\prebid-8.52.1[1].js

Filesize
440KB

MD5
c27c6366ec9b1d096305db4b1c6ce4ca

SHA1
8266cbe64b94d7caa1fb63e2ecb396d2f01bd709

SHA256
ba2abfb3ad8c0527f0ce6ef4b4f919169cd214b269db74095ee585b9cf42f828

SHA512
4d3697da4d1479cc074269decbda9103895b44a451784befd448e4669bf57212fdf3e9eefeaa88d6089a05f268a0648fd297e44a5293cd5bf490bfb23451a946

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\K3QN37R0\vbulletin_important[1].css

Filesize
404B

MD5
a673355d8584187d4155cefe9fe2817d

SHA1
e353e43656f6193bf0d37666792e372c8d1129dd

SHA256
e658790158fe348fcc8d328c7c8bd06aa42ce2cda12823e771cf04d21185ef88

SHA512
8c894cac56ff718397ac874971f423a37f9a16da76b2338483fc7c18a2de431caceb136142a99571475731c5be767cffc3a3aa10dd1248df8e8a9bfc0d742215

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\K3QN37R0\vbulletin_menu[1].js

Filesize
8KB

MD5
9c61250d03ee4d10900b1313989525a4

SHA1
68b2ea509ec1caaee1e028464f0d5d13f07822aa

SHA256
183f9a7c5ffb8321d9ba11e68c274f4060d0c9efc87275402a94c41ba5f59a04

SHA512
3c298bf7e481e0af748995f55da8482eec92192933d51e23b4e99610773e0980866e337f13cdde972cc25f79bf85817fac0f1aba65a93a1cc1d84e86f825eee1

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\K45PWI2A\cmp2ui-en[1].js

Filesize
424KB

MD5
5f32a75002df9053a3ec6c39252e2946

SHA1
c77d09312f39c584f10482d2fe60913ffc306dd4

SHA256
607d59d75b30f7e9e57efba05697b89ffd8b7f1559d78d623fa987d9328d1815

SHA512
04194651ca1a8dded10f832c7fa8c74a1c8bcbe5a98366bf71e72ee23e551aedd277d6587489ffc67a33195e53901eed76bb0d9d136c5db4b2ebc0e80c15a79e

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\K45PWI2A\connection-min[1].js

Filesize
11KB

MD5
ed935da9668b7350505daa30027a6f44

SHA1
10ebcea9a5b9a89ad271c462fdafb5d012b9af64

SHA256
a0297b3ea37cda46af5a08ed89b1563987e6f6a233286e1a373668776134841c

SHA512
b53009564c3e69ca1803a4f185e647226dbcaecd2bd58a7f0ff00645e475b13f163c3bd243000356843f8dab471c6eb842253cd2f74f9ed4e86155f3b3d853b5

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\K45PWI2A\jquery.min[1].js

Filesize
90KB

MD5
397754ba49e9e0cf4e7c190da78dda05

SHA1
ae49e56999d82802727455f0ba83b63acd90a22b

SHA256
c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4

SHA512
8c64754f77507ab2c24a6fc818419b9dd3f0ceccc9065290e41afdbee0743f0da2cb13b2fbb00afa525c082f1e697cb3ffd76ef9b902cb81d7c41ca1c641dffb

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\K45PWI2A\js[1].js

Filesize
289KB

MD5
cd7e491486b978f5f0f72b63fa482371

SHA1
e70d6a060f6767355b4ca83ea13949af058ef9cf

SHA256
9e0a416bb1917e9c40f8015e8ef34f1e329c8b8f093c0b5c6c8033417c732317

SHA512
d3c3d054bc9cf66403fb9777f5f8d7b78e794f91826adbd98e5dcf38474028751c2aaab4d98b2e70bf36fa1411909ceb75fad82ca01c28d2b149831ffc5bb13c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\K45PWI2A\prettify[1].css

Filesize
1KB

MD5
ff0e971619a2f6d0ade9de1b6965f61f

SHA1
f4ef95421b7a8ce55110586f0e2fb29ed2364e14

SHA256
eeaf7add3eac1012ec3ee5fc79379c7feb1ec7f20a86322c5393a434670a531a

SHA512
d1d46cbd7f101aa636e3b1d86f6f371796cf14589007fb7d6ec48ba41045cb50fb2a5a6b8e8836e8421933f9f02b1038216f93fcd170787f57297e069841a4f6

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\K45PWI2A\rules[1].css

Filesize
1KB

MD5
782dd8521b92c2a9294dc967ba6222dc

SHA1
5d8505c8153b41718bd53980dfb719b9fe556ad8

SHA256
2780651c323e53cca7ae519606eb34d635b8862bb33fdf7e06cdc4c0a39a2fd4

SHA512
bd0616ad84ad033154824bf34a2cabe9924f4c4e533b37096ba7b54c133d53b9d423d3cc3386be76b2a015fbeca01bdf7a4bf80fa9ca52617395d8071c768788

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\K45PWI2A\vcd15cbe7772f49c399c6a5babf22c1241717689176015[1].js

Filesize
19KB

MD5
ec18af6d41f6f278b6aed3bdabffa7bc

SHA1
62c9e2cab76b888829f3c5335e91c320b22329ae

SHA256
8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f

SHA512
669b0e9a545057acbdd3b4c8d1d2811eaf4c776f679da1083e591ff38ae7684467abacef5af3d4aabd9fb7c335692dbca0def63ddac2cd28d8e14e95680c3511

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\UHU0AQ88\choice[1].js

Filesize
3KB

MD5
bd7ef9623b6820d9deffd6219d4b9bf5

SHA1
7ddc76c07a7e41f74e808a0c7b996df96ff13010

SHA256
054fb9d82970d8f208188f156510e470f4ee60c1a0f0e2fbdb3c3d20072173b6

SHA512
24cdc084745c707bd968ed6ed14fb2dbe21600c25d3079f0d89ae62a3fc054692143cd86425837a14ca7b94d6db9f981b69fd8b2f9403cc7902c0723d25a842f

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\UHU0AQ88\f[1].txt

Filesize
100KB

MD5
bcc5f771c6708bad9856b6007d004565

SHA1
fe9cffd2ec35cb8759dc9f09c82dfbbd90418803

SHA256
51ada36a533548e6fa48fa2dcbfe37964f51df529622a7ea408f1529c315b3b6

SHA512
2211cae267a65832e5fc3deb4b814694f05981455fd325a3a26992868fbf8569acfb61c9c670eb55c4ed560e9662cde6db8292350930c02e053223baae0a53fd

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\UHU0AQ88\geoip[1].json

Filesize
48B

MD5
c5c0c9220f8918932c3d83202ace5dc4

SHA1
7026f4f5672431cfa396f25a46ef3ebfc9701a29

SHA256
be0225e5f79cc0803899b0a4466dbd541b54c96e903dc8f2da6f23d4da02419b

SHA512
054cda0582bdf7e5dbacdea9789cbaea17a3fd9606ebe386e26d8026d1dcfc04696fb738207e0379cfdc8900de2e99f67e21fa41339ce9997d1a95d97df4a652

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\UHU0AQ88\rules[1].js

Filesize
25KB

MD5
0678493617bf9e4d59d74232eb90e1b2

SHA1
6cd8263d84f0160782951b6dc7043a400663b53e

SHA256
6fd61e1e2626b6296ebd7e1986848520b702b36d78f9fe9ddf34449b1daa5e26

SHA512
fb6225b8b5bfc74daa7b6f9a3cfacc8341816f547c3930ecb7f34693e82f784b7a5839c9bdde2b7f31dc8ff383a691d38788a827979a88fcbd2852a15bd0e997

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\UHU0AQ88\run_prettify[1].js

Filesize
16KB

MD5
49f9edd8052acc38152a12a359598146

SHA1
af0c1b26c7b94431f9cecd84c3e27255593c79af

SHA256
b3b8bbf477cc5f4448f15bcec10afbded3707219ccb6244448b85e0854c0de11

SHA512
f7546ac74e6e0a6805160d1b35a2a2036bc2202ff7e79d4dce3052d784a7a9748c5bd00170ed6c536ad82cf0ba56e2b3707bce1c4d7454702b5b562fb2107bbd

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\UHU0AQ88\usertitles[1].css

Filesize
10KB

MD5
2cb5917685c87347c1a92b1cb5efcef9

SHA1
bf15649ad62dadd410c120af4369bdfab797f07a

SHA256
29613220adae0f4ec529fb7ff252d75145c96e7566461642579f4f491eb3ee4f

SHA512
42ab7b8465b776bc25c1068d7a80ac6e9247541c2857d184b233b26eab18c324f06b8168d842694676d3128d280002781061136dfb3c321c4429ff879a3597f1

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\UHU0AQ88\vbulletin_global[1].js

Filesize
24KB

MD5
399ff4ec0b0b9e79dc43a4984a38c520

SHA1
c5a0d2c7ff4ba0492dc2b7ad42b8cb58b49899dd

SHA256
5daec86e296b73a5efc0d38d2ba51810c6be5e1d9f2344ea43d087285f145bbc

SHA512
e09f18cd24693fbe1852c02b594f75dbb783ba804ef7d3589d4218a68a626eaf531dcac7259371387a8105381af11a952048903c6c6f2a54c8490cb4fb6f8fe7

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\UHU0AQ88\yahoo-dom-event[1].js

Filesize
35KB

MD5
6284c4fe82825f3069a9ca5599a56492

SHA1
b6911bae8a5e15c5ef04bfd069cf904e33b7c202

SHA256
210415b78a14ae0ea35a1128937bcbf750649cafaa4d26dd4b20abf9125f76c6

SHA512
ae96c7a2d0a451a3cb742505217108db53652d6d3978b1c6786a9f2995b29b28669b5962cfd14a3d1fcc092d4175687bd00a44754a5b8f5e91d6e0bc0d32e580

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\Z1ILFSW5\adv_teasers[1].js

Filesize
174B

MD5
9d0f4ebfffa9c3472d31dd95fb3e87f5

SHA1
f331939bfcdfc2a6a1d26d846fb3d217ae17b3bd

SHA256
5d0906ba33e2053f9229934e6e9459e5affd7e2a23a32119679b4640beeb480e

SHA512
9f5e4055be09a930887d3ea625501a34777df5534e00985b9bc92b06e0f481ea8f9fd96925add5b9a0ed7a636a24c0d238213228dfc95a7987c3a06a212456b7

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\Z1ILFSW5\apstag[1].js

Filesize
312KB

MD5
f3827e9e649a0910d70a775d66bf75b1

SHA1
615df82cad4123e15396f323ef76e449aca50e3f

SHA256
57de7fe2b12a7adf68bde842a680e51423f5fb940c4fbade7dfb721e22907ec8

SHA512
14e1e365a9280bbe96da44696d0dbb4e43f732bde1e93e9f51d026675c500eec31e4c84fe98ab4a05707761ad455f1c3f2cf60b9318b0375c3d78a98c2f1ebf5

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\Z1ILFSW5\email-decode.min[1].js

Filesize
1KB

MD5
9e8f56e8e1806253ba01a95cfc3d392c

SHA1
a8af90d7482e1e99d03de6bf88fed2315c5dd728

SHA256
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

SHA512
63f0f6f94fbabadc3f774ccaa6a401696e8a7651a074bc077d214f91da080b36714fd799eb40fed64154972008e34fc733d6ee314ac675727b37b58ffbebebee

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\Z1ILFSW5\style-993ca8d2-00033[1].css

Filesize
5KB

MD5
8ba47c69883bf0669a51de4cc6f4678c

SHA1
f087de936c252388c7355a033f23acb2573c3b86

SHA256
1b6db38d6efcac0437b7eb841161dd6f5cfa113d6d3962271601ad2313fe7a16

SHA512
f91010cefc4e7f71d699d21731e303792a4b9e564617cc4c327a80c3af2e3e1c489e9496654fe568bd98a1b20ca50b7299ee62570a0adbbecdf6961215626eaf

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\Z1ILFSW5\uc_imageresizer[1].js

Filesize
4KB

MD5
6d2047446bd703d205eff08da3e93ce4

SHA1
96ed03f505219c501796e094402127c91ae6aad4

SHA256
9d2475aaa70c3d241c85f61b88a1c6d0b758710433c350a455f63b0c5fd3e29a

SHA512
cf3b56569c9bf5374c2d38148f1cedb224fd1f56d111aacbb2ba968168788574022cff9582571c2ef29fc369fabf433b5fc586fc99ef652a037a190ec6dde5c1

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\Z1ILFSW5\vbulletin_md5[2].js

Filesize
5KB

MD5
5197e6df4b7a32c54834cdc210c866cb

SHA1
fa94d8ae90bd9a953934c4c4020718530aa8131c

SHA256
6e4ed9f4271f22c3bb4405155731f16c131e71d4c752060017496c0bbd2d5c85

SHA512
905a3b4e7ff32761ded7bf52b3bd6f9e0ca5934a014d22fbb24d3a86b88526ef6a873731da6d2dcb89ec8a13ba2b807ad365e2624c9caf10cdb3fc43392c55f4

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\Z1ILFSW5\vendor-list-trimmed-v1[1].json

Filesize
601KB

MD5
4d39f93d0ea73c8f70e0902b2678e3ef

SHA1
cd724977447f712f9ef56d183ab106efea6c4d67

SHA256
b3a6c0ff622123f6fc1ed8d1e81c77676a44ffc3f5b68c1038ea0ec293a83bd8

SHA512
aaafc6310925d74793da4c10c5b474d338579a40eb5731e9e2fb27fb9bb644761402993e9c97e4717f540e6746fe2cf88853c48832617eea349bbf5e21e79731

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\SJNRXHJA\www.unknowncheats[1].xml

Filesize
4KB

MD5
a06db84265713cc41d8864cc14099c68

SHA1
6d099b79cd491af97def753ece57519bff834118

SHA256
af0f92a42f8042c454d0f065e92f22a3b883573735d552b870fbf626127d9bb9

SHA512
a68714418d3eddbb3f1cc64d08e5bd1c92e126f5f4f958c770ea5ef94ca8b4a6d8539f4d4a0a1b19c9e37ed667d8587ce3dea6e095ccd9b033bd339b281646bd

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!002\MicrosoftEdge\User\Default\DOMStore\RNUNSSM2\www.bing[1].xml

Filesize
1KB

MD5
43275de1308773f0f6caf3b75776bd42

SHA1
3a5a872c395ec5d6351a8d9f542cb0f49d7c384b

SHA256
c1b494a70ea7d06891b26fdb7b87f2784116c1783a62cb90547bfd6058c62503

SHA512
46e2dc881a846c6081354b7ad27785089fadf3333ab5823eda043b7d40f08400b452cf5cd93b8506a95e2d98a8be0b711a2cf6ba53ae86269bd19783e526c64d

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
4KB

MD5
1bfe591a4fe3d91b03cdf26eaacd8f89

SHA1
719c37c320f518ac168c86723724891950911cea

SHA256
9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8

SHA512
02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DFD85C276913CA27FA.TMP

Filesize
16KB

MD5
b6e1741fd8d3e0527a9c4a2cce74ccfa

SHA1
7beaed9f80ce212c4baf9fe0e388db3c49b03bfd

SHA256
03837777dcca2f071feeec4fe6c770c38ab55c198d82e87a52a768b84d10cbd7

SHA512
518289fbe23d27ba11beea0fc9ee04cce0569962d0914490d629c41fda5832e344ad0b49c97b05c57b6c956ed20b2ade987def5024cf56ff7fc14ed6092514e1

Download Submit
memory/516-42-0x000002986EA00000-0x000002986EB00000-memory.dmp

Filesize
1024KB

Download
memory/984-164-0x000001B925DE0000-0x000001B925EE0000-memory.dmp

Filesize
1024KB

Download
memory/984-175-0x000001B927190000-0x000001B927192000-memory.dmp

Filesize
8KB

Download
memory/984-179-0x000001B9271C0000-0x000001B9271C2000-memory.dmp

Filesize
8KB

Download
memory/984-181-0x000001B9271D0000-0x000001B9271D2000-memory.dmp

Filesize
8KB

Download
memory/984-183-0x000001B9271E0000-0x000001B9271E2000-memory.dmp

Filesize
8KB

Download
memory/984-185-0x000001B9271F0000-0x000001B9271F2000-memory.dmp

Filesize
8KB

Download
memory/984-187-0x000001B927210000-0x000001B927212000-memory.dmp

Filesize
8KB

Download
memory/984-167-0x000001B926FA0000-0x000001B926FA2000-memory.dmp

Filesize
8KB

Download
memory/984-194-0x000001B9274F0000-0x000001B927510000-memory.dmp

Filesize
128KB

Download
memory/984-165-0x000001B925DE0000-0x000001B925EE0000-memory.dmp

Filesize
1024KB

Download
memory/984-155-0x000001B915500000-0x000001B915600000-memory.dmp

Filesize
1024KB

Download
memory/984-152-0x000001B925FA0000-0x000001B925FC0000-memory.dmp

Filesize
128KB

Download
memory/984-101-0x000001B925AA0000-0x000001B925AC0000-memory.dmp

Filesize
128KB

Download
memory/984-177-0x000001B9271B0000-0x000001B9271B2000-memory.dmp

Filesize
8KB

Download
memory/984-99-0x000001B925A00000-0x000001B925A20000-memory.dmp

Filesize
128KB

Download
memory/984-173-0x000001B926FF0000-0x000001B926FF2000-memory.dmp

Filesize
8KB

Download
memory/984-67-0x000001B915500000-0x000001B915600000-memory.dmp

Filesize
1024KB

Download
memory/984-61-0x000001B9148A0000-0x000001B9148A2000-memory.dmp

Filesize
8KB

Download
memory/984-63-0x000001B9148C0000-0x000001B9148C2000-memory.dmp

Filesize
8KB

Download
memory/984-58-0x000001B914870000-0x000001B914872000-memory.dmp

Filesize
8KB

Download
memory/984-171-0x000001B926FD0000-0x000001B926FD2000-memory.dmp

Filesize
8KB

Download
memory/984-169-0x000001B926FB0000-0x000001B926FB2000-memory.dmp

Filesize
8KB

Download
memory/984-241-0x000001B927250000-0x000001B927252000-memory.dmp

Filesize
8KB

Download
memory/984-324-0x000001B9266E0000-0x000001B9267E0000-memory.dmp

Filesize
1024KB

Download
memory/4340-16-0x000002A247820000-0x000002A247830000-memory.dmp

Filesize
64KB

Download
memory/4340-0-0x000002A247720000-0x000002A247730000-memory.dmp

Filesize
64KB

Download
memory/4340-35-0x000002A244CD0000-0x000002A244CD2000-memory.dmp

Filesize
8KB

Download