hxxps://github[.]com/Da2dalus/The-MALWARE-Repo

Analysis

max time kernel
1800s
max time network
1592s
platform
windows10-1703_x64
resource
win10-20240611-en
resource tags

arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
submitted
02-10-2024 21:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 6 IoCs

Processes:

MicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

browser_broker.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 5153904f1515db01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 1d914d4f1515db01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\NextPromptBuild = "15063"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$Telligent	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\FileVersion = "2016061511"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CRLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\MrtCache	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListInPrivateBrowsingAllowed = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "395205405"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe

Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

MicrosoftEdgeCP.exe

pid process

4504 MicrosoftEdgeCP.exe
4504 MicrosoftEdgeCP.exe
4504 MicrosoftEdgeCP.exe
4504 MicrosoftEdgeCP.exe
4504 MicrosoftEdgeCP.exe
4504 MicrosoftEdgeCP.exe

pid	process
4504	MicrosoftEdgeCP.exe
4504	MicrosoftEdgeCP.exe
4504	MicrosoftEdgeCP.exe
4504	MicrosoftEdgeCP.exe
4504	MicrosoftEdgeCP.exe
4504	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

MicrosoftEdgeCP.exe

description	pid	process
Token: SeDebugPrivilege	3780	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3780	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3780	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3780	MicrosoftEdgeCP.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

pid process

3776 MicrosoftEdge.exe
4504 MicrosoftEdgeCP.exe
3780 MicrosoftEdgeCP.exe
4504 MicrosoftEdgeCP.exe

pid	process
3776	MicrosoftEdge.exe
4504	MicrosoftEdgeCP.exe
3780	MicrosoftEdgeCP.exe
4504	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

MicrosoftEdgeCP.exe

description	pid	process	target process
PID 4504 wrote to memory of 4296	4504	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4504 wrote to memory of 4296	4504	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4504 wrote to memory of 4296	4504	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4504 wrote to memory of 4296	4504	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4504 wrote to memory of 4296	4504	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4504 wrote to memory of 4296	4504	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe

C:\Windows\system32\LaunchWinApp.exe
"C:\Windows\system32\LaunchWinApp.exe" "https://github.com/Da2dalus/The-MALWARE-Repo"
1⤵
PID:3652

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3776

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:2752

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4504

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3780

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:2212

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:804

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:3896

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZVQ9VIUB\edgecompatviewlist[1].xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\XIJCFXY9\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\AWB48L7J\dark-9c5b7a476542[1].css

Filesize
48KB

MD5
c21f8fd1aa4306567381fc98c4658451

SHA1
8b1a242ba7d5c59596d31580b5b8f4a7bed32726

SHA256
396d793cf41edbb2964b3993c58be3224430678db6de696a3940d01eb3ab43b1

SHA512
9c5b7a4765424368e00d62b4ae89aff8c5b86fc4e93b09d49ac4d1b18f65ce9dfd3fae52e9ac25bb0d0a024ea9a08e638a36cdc278111cd7e62c5be38a1fd23c

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\AWB48L7J\light-3e154969b9f9[1].css

Filesize
48KB

MD5
dda4611c92e86740cc9ea1301c6ea9f7

SHA1
1d20bb0250a31e8f62cd738a41881d0155ff9726

SHA256
16299e8062cd02bb5746969f27f13765ff6ab6108a88fe69925007b65134e0c0

SHA512
3e154969b9f981782a137ade0196adbdc3919c451a134f632b4f748faabd3136e76013775f56bf3acce47e40b389a209ba3b9ae7c3b554f4619e861c128d1de9

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\AWB48L7J\primer-fefb1a332c28[1].css

Filesize
332KB

MD5
ad0b6e40828a9f272af97c84e6e4d5b8

SHA1
8d7da19114bbe12914c66c78fc31ce29111a623c

SHA256
5e154c648de1db76c62a206e82c06a87da452d1e40ffb8fd65b2f206e2202060

SHA512
fefb1a332c2812530daac3edf706229e43a55903422494b5566ba35de8c2d8322367dc60046ace9fe404dfc67e896d82e75a5a3ea7a6e4e08206f845c37769c1

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\AWB48L7J\primer-primitives-4cf0d59ab51a[1].css

Filesize
8KB

MD5
095a01e2f3bac9b2b48bb28ad38a4a8d

SHA1
91855599af787299cece3999adaa4e440dff84dc

SHA256
555bd75cf2fad0dcfcbb3578d074a907d437f0832629f3d6f83c9cc4ae8b4eaa

SHA512
4cf0d59ab51a237735819fe02c3b39528990b6717c4d555dad7053a842ac428aad3166e66699e3277cd4d4d3a3e779b4896ef42b1c26934e0349b706d3c077c1

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\AWB48L7J\vendors-node_modules_github_auto-complete-element_dist_index_js-a164c5ea9f62[1].js

Filesize
13KB

MD5
203cb83362a88a295c23c88e26320253

SHA1
ba89a34554422d79c91873fdf7116cf9e4caf1c7

SHA256
a3c06fd5154472e1d8c8cbf2105912205a4fc75b9b6a75b273859edc30bfbe9d

SHA512
a164c5ea9f62fce49ae15eb21bd3f1a3bddc116674e712f7a53053fb64ade3c0aaee903a8d841ad82f8a54e658f3bb877076de25ac69437ff5529a3e4aaaba95

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\IEDDLT5U\The-MALWARE-Repo[1].htm

Filesize
299KB

MD5
38db9e717521100af514743b60bf834b

SHA1
efa42a4ae91cc24d675735857dc3d3a5e72c976e

SHA256
63db01ed95e5d5ff29e13049da11dbf1e1ca5bcb036d673a857e1cadaf790bf0

SHA512
54281ec2b01a37042d7e222c6f64e964385785c96033f3c8406e805271af7e999c58b2a83d6facf0fa3416e891f086a600a9f00e74fc6fb1f9da11e59d960697

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\IEDDLT5U\vendors-node_modules_github_relative-time-element_dist_index_js-6d3967acd51c[1].js

Filesize
15KB

MD5
e89cac3e3116110f5678d2857d9803d4

SHA1
c357fa95477a3a0a1a63dec0e9d2433d172bd005

SHA256
bf6dfa6b068f933d79071102dd912171c8feea27e9bb3f332ec9e6c358e199a2

SHA512
6d3967acd51ceaed2dc7390dea496c2db52afe8eb556126ee2b2f52b0b127e2869a921146554e8d1809ef22c2aba53019700a283f4362d85b226ad6fb1f5871b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\IEDDLT5U\vendors-node_modules_github_selector-observer_dist_index_esm_js-f690fd9ae3d5[1].js

Filesize
9KB

MD5
e131f8c9b77918aeb94fd82199a423d6

SHA1
71eaae086cd44a8904f39d27fb5387bb957976f0

SHA256
01f9a0ec0bb24312ae0395b6aa238f8d910dc35c08ef5a25a1e9cd8feac83c32

SHA512
f690fd9ae3d5a240e479fea97ac82940f136f3f2e0262cac840345f2b956123117ca94424dc354d90d13f1c0169c24b19526505bb2fad70c8c364899474a9495

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\IEDDLT5U\vendors-node_modules_primer_behaviors_dist_esm_index_mjs-4aa4b0e95669[1].js

Filesize
16KB

MD5
6c7c591d15bb45ff5685123849338fa3

SHA1
7f1c36b3fede6c0020efbe6daf49edea2ff28082

SHA256
a020d57ae1d21c34a4ce98538c1c63f112fd3b7a5e4809d377356df0d74b9dd9

SHA512
4aa4b0e9566911a02a88dd7c9489c05aee4819549b15d3139cc22c2e91dd44611bdd25754c8677bad0c239f59395eb9b62031cd8f1845f5d68dd57d71f790148

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\MBSZZS7G\code-5fa7b9088c7e[1].css

Filesize
28KB

MD5
3d3d5cfa1c6cb53a996a6f1b8828fccb

SHA1
6b894d496e88bc5623d56b419f8b37e12eba88bc

SHA256
184feefeefe33ded252d65bf7cb6b73b16bfeaa175a5a061a37fc3b5375411ea

SHA512
5fa7b9088c7eaa47f3891c887eede00a6d5665e11d63fb5456d9353323ecc936bafc30df73711c403f9ff895b7888dc746df4c6e84e34bb3f5ec577db4cddce9

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\MBSZZS7G\github-d1e3b63864f7[1].css

Filesize
114KB

MD5
b68742eb9da1edae8072fdc374e26322

SHA1
3ef08595286e41b825c61194b95d7a279279b99c

SHA256
1771f04e7733639b57a3ca852d986df4a2239167c605af541a0582aa88d45335

SHA512
d1e3b63864f7a914e9695ebe4486afbd9928ad19d7f8ee2f04d6529b2c2ecf06cedea4b37e37f6aa879a8471f5a6df19367c0ae31d119bb92b7cc936e631a995

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\MBSZZS7G\global-937a43d3e0af[1].css

Filesize
276KB

MD5
e7aa4cd305f8537747a67caf64e565fc

SHA1
61d97746e8246d27865577af4679afaf85bd92d3

SHA256
f1fa3e6ca98e37b83dd2ecf7a728b06a08ec3c55b55f81546550b619f7b5ee44

SHA512
937a43d3e0af3ed95b471ab384482fec75876762d4b7d0e68148e1a73602ffa6858c50f38abdc038c8af20e4ab7a2bb18c3b7b01c808a70059e047e73e142c22

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\MBSZZS7G\repository-0f7cf89e325a[1].css

Filesize
29KB

MD5
1680289ab5dba7c7d2f122630b9c820b

SHA1
d24856e6233eb9a45e9b60e822c6dd92f32efa40

SHA256
81488a04cf8146db85d91c58695d5147a7a02d6ac61210d83decf90fe5ac9247

SHA512
0f7cf89e325a36d5dad6762760cd27d42e2b00c2adde6c5916a1872e536ad2eb02ddc58b4e5e67fdcde705677429cc8c353a8669bf0c4cb678b9053530716b0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\MBSZZS7G\vendors-node_modules_delegated-events_dist_index_js-node_modules_github_catalyst_lib_index_js-f4b251-f7c3b6081b19[1].js

Filesize
13KB

MD5
07db8fd7c0d6d1d98d1e07156a23c873

SHA1
26c0a8e9de88a9e88e96985613b9145ecc294d2c

SHA256
18c24a8fd0f795bd9220dbdd2ef08c8b0ee030dc0123af5a570555d94fc61dbc

SHA512
f7c3b6081b195e4be03cb8c99b16624a685f2f7a3c39a9bdcc0f8e439019e8ab6640a0a2673d5597dd1808f149371a05c9be8a9ad7f41759e6ba4a3433ce0cff

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\T3JM55FU\environment-2f240f7ed1b3[1].js

Filesize
4KB

MD5
7d6d4c80201b925d4aeb993e4f40af4f

SHA1
95e341beb912114aba5991310796fc50be5f189e

SHA256
7b35d9455560b39afa30c2db9993a6495c2d82d41212d4eac59ad6d7d320abf3

SHA512
2f240f7ed1b3963794a3e58a15205239f1f754ca88c00c0988d71b7fc472f7a6e2be1da811c063666463394703bd1200614427afbb06ad9e24f1e66b43079e4b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\T3JM55FU\ui_packages_failbot_failbot_ts-aabfa4ec15fe[1].js

Filesize
8KB

MD5
84740cce33e5a31d80be06f32935cb50

SHA1
9e178476116ba28f58c4374546af052bd0bc0b4d

SHA256
4cfa417546406b106fe34920cf0befafed5d5fa40d1a723e121830132db81d3d

SHA512
aabfa4ec15fee097e1bbb782cc2cf111e627652ab5bb5dd9015cdaa1247db9ce605553ee0f297985cce3ff2a17cc0361e856d029fa8e83bc6c1972acc86aacf3

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\T3JM55FU\vendors-node_modules_dompurify_dist_purify_js-b73fdff77a4e[1].js

Filesize
21KB

MD5
383e44dccc233540968acb7fef070359

SHA1
18a5430a0b2ca2bf000d86e08c54506a353d7c05

SHA256
e099ba09d44edcddf0de12aa96dbc7aae4b03749e57b865b7310d1b1cb6a8484

SHA512
b73fdff77a4e401513d1f7f003641c229d65e0dac7f94754956cd8006e8cccb576907ebd697dc75e857ced074381175db487ea75bba2ccc8238e913e20fc23a1

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\T3JM55FU\vendors-node_modules_github_arianotify-polyfill_ariaNotify-polyfill_js-node_modules_github_mi-247092-b9c7cf3107b7[1].js

Filesize
16KB

MD5
296c61843cf768161b75f8ba7db0803a

SHA1
a2fe171b4773a7ee5fe50b463cef3cf99585a712

SHA256
dc3a837b7d3d883b43e92ca92dd8172255ee4a8254ae3d59075c955156d0eebf

SHA512
b9c7cf3107b742310fca225fd701b7035cf3f8ac9438c3b1e0bc1eead2c0747fc1e8ff9849df20f13e8ee54054ec0e383e6a35919f89d8bcee7fb9e123ea7bb1

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\T3JM55FU\vendors-node_modules_github_filter-input-element_dist_index_js-node_modules_github_remote-inp-d1a841-8f251a0656e7[1].js

Filesize
22KB

MD5
8c557e610c6b359c85f8e2fb2d7d7a89

SHA1
2047d14a8a0a01a3fea77da84585c89b9bd9875f

SHA256
1d3779a9c6dd13af8d7f1e60be1c2e4f08dcfc03a6921c0a83be4f49d631cb6b

SHA512
8f251a0656e7712b5b54eb6e41e9b4fb2a7f0ae4ee6c65a03ecfc0bad475fdcc56191fd588d9fbe7f93bdafd2545d37ede16ba0e8d03d3f4d2aa986fab7c9087

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\T3JM55FU\vendors-node_modules_github_text-expander-element_dist_index_js-e40ed7658a74[1].js

Filesize
14KB

MD5
228c23e82e6508008d9d90c7c5e5d676

SHA1
608ba2203b26ba3953164f4cdc082010bbe5b515

SHA256
0a539066142a2dbf1e6dcdf2a49ee64839c7e73851a3c18cedec91f41df13b5d

SHA512
e40ed7658a745cfd613a689cfda47868a3075c0ae08eb872b00a606d310684bf20c98551f1aec7ec196830ac55c01f51985ad5e08a8b953583a306f23aaa1c20

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\T3JM55FU\vendors-node_modules_oddbird_popover-polyfill_dist_popover_js-56729c905fe2[1].js

Filesize
9KB

MD5
2eb9961e08f81bdca617ddb67c2fb708

SHA1
15cb6d7ffe93324b38bb62bcc4ff14d1a57f94bb

SHA256
0f2cd40ad364711db1fee03cf9f6ca04fc56f5c3ba497dc476c5879e129d968b

SHA512
56729c905fe263a6b7978bc67c09b8dab69592e21aa9addba78866790bdb2dbd85e41e6a6663d511e73a8edeb75933b549b3c393a465748790a6fd50b337cee9

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\T3JM55FU\wp-runtime-df2d620b3ef0[1].js

Filesize
54KB

MD5
be11bee976d97b7f2944087d75921456

SHA1
561065007e40b581769231a0f8666307fca2d41f

SHA256
99c9818fadb072f45989796f4f35b8fccbfc6163f86633d2d23e6ddb6a2c5db0

SHA512
df2d620b3ef00862e40c44f3bed1ffd90063174ecb77d9cbaead4c03c5c0b34550a59650fcf70b673e57afa11b282dff01be691407e8c3f9a5b4c300bd1088bd

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\G65BDWBO.cookie

Filesize
168B

MD5
bc7f096447d7eb9fe017d2bb6a287d95

SHA1
41258610c2fcdac290bac6d912398cf562105ca6

SHA256
d66eaae5bf7ffea123a2358206d66ed11a14310a915331ec025292128376546f

SHA512
e230cbb35da2e3886a3f2d250087f45a663bc95fd264da5db9552e2480f7e87e8d523124d495918e1d58e4f73a89e0dae39aec0ec358f982d389174de8bfa5aa

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\A66A8DB907BADC9D16AD67B2FBFFDD5C

Filesize
281B

MD5
800e09a7c1e1c34f005969e27a41c30b

SHA1
6787b33fefb90d17cef9dd25a0c7dc3f64a5552f

SHA256
8a21e02070b91dedf2a7e5761c196f32e469862ee1fb5efa65342410d65ab342

SHA512
efadc02837b1665a5c1744888b74f1d9f3c9a3be59b5155da2b49e166ac9ce882ef5b709d4cb716f2fdf42c9450d7158acfb2b0e488ed7c1c6ff2cbf15581d27

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25

Filesize
1KB

MD5
25c54fab7220ecfc73a988bf72d56cca

SHA1
5f0f0a726613fbd50006545ddde92110b971d614

SHA256
1bb22f0189b4f8002ce72f04ace06dbde14f8b6feded81e8c239faebdf11f513

SHA512
9f1c882105d0cfd2cfd3b1fd0b166d592ac2248c4d1322d85cf2b1d3c4b41c184a7312f0a0759e67c597829d9613a67595c89ff5320137dc89a77bc1dc639af0

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90

Filesize
979B

MD5
9f3e8c2907cd62e912e00b6140bad286

SHA1
dd0af1509676dd3e9e41a80c605e9a79002ac547

SHA256
1fe2e880f935d802ca1ae4e5fcb0fd12ab600193d8400527a7a7079e6833ceba

SHA512
fb8d0e264d0b430be3a34dd910bf8d04485543bff0855b704ce6ee4be168553d4dc38397770b7c4e8eb9033dadfdea4d538f7743719fd763b35e2f35fdc08c7b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\A66A8DB907BADC9D16AD67B2FBFFDD5C

Filesize
480B

MD5
1ae0f2947f145496844651bc59e1b42d

SHA1
e30c914cd46f2c45fa2fc2bce118aedc3700a133

SHA256
9039ae6fdd91ac127b289fe4a90a3cecd6c10b084a1e70f54f9642d4d1aa0435

SHA512
1bc9df102da10c649ed4e346e958beaa3e2d7d063d0d3ff55ca4fd0e5c121f94860b3aac8c23c3793f9600336543d5659ac4a3ecf2d5ebcb8930a6e3060e2137

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25

Filesize
482B

MD5
8d42887c7ba8211d68f2f031bc3c4a56

SHA1
8fd546afe9bc6ac743f23f000f440fe65ffe1561

SHA256
e76c37b30c43c3ff5b13255dfc54cc8b4d103c476b6dbfb124c72d0bc499a406

SHA512
cc931f4727d1417b55648519b9e0222cb456a603ed6913be4f7a58b58713c870a52d12d9d044f5deadf4d6b91c037db520ceb84c35e7be6a1a18132f4be3f81e

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90

Filesize
480B

MD5
bd7f35f91cab7a6a0592539733ea8078

SHA1
3d0e6986a39a93a834bce9b0c9464145590c0513

SHA256
b4f51229de5d3e71c9cd4adf73318881478d7357bc153c42fe14f19678301218

SHA512
23ab21c145a9c76ffeda015e6b208bddd6e7eb48b342c1ad5bcd38ee3db8637842381a395b307fc39c038bd3532aca2ad9ec8339689b90ea863f90b66962a3a4

Download Submit
memory/2212-63-0x00000213D4400000-0x00000213D4500000-memory.dmp

Filesize
1024KB

Download
memory/3776-35-0x0000016F129F0000-0x0000016F129F2000-memory.dmp

Filesize
8KB

Download
memory/3776-16-0x0000016F15520000-0x0000016F15530000-memory.dmp

Filesize
64KB

Download
memory/3776-0-0x0000016F15420000-0x0000016F15430000-memory.dmp

Filesize
64KB

Download
memory/3776-248-0x0000016F1BD30000-0x0000016F1BD31000-memory.dmp

Filesize
4KB

Download
memory/3776-249-0x0000016F1BD40000-0x0000016F1BD41000-memory.dmp

Filesize
4KB

Download
memory/3780-43-0x0000024587700000-0x0000024587800000-memory.dmp

Filesize
1024KB

Download
memory/3896-205-0x000001DAD7E00000-0x000001DAD7F00000-memory.dmp

Filesize
1024KB

Download
memory/4296-224-0x000001CA41FC0000-0x000001CA41FC2000-memory.dmp

Filesize
8KB

Download
memory/4296-228-0x000001CA52C80000-0x000001CA52C82000-memory.dmp

Filesize
8KB

Download
memory/4296-232-0x000001CA52CC0000-0x000001CA52CC2000-memory.dmp

Filesize
8KB

Download
memory/4296-230-0x000001CA52CA0000-0x000001CA52CA2000-memory.dmp

Filesize
8KB

Download
memory/4296-218-0x000001CA424C0000-0x000001CA425C0000-memory.dmp

Filesize
1024KB

Download
memory/4296-226-0x000001CA42400000-0x000001CA42402000-memory.dmp

Filesize
8KB

Download
memory/4296-222-0x000001CA41FA0000-0x000001CA41FA2000-memory.dmp

Filesize
8KB

Download
memory/4296-217-0x000001CA424C0000-0x000001CA425C0000-memory.dmp

Filesize
1024KB

Download