a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d

Analysis

max time kernel
151s
max time network
139s
platform
windows10_x64
resource
win10-en-20211014
submitted
19-10-2021 11:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MEMZ-Destructive.bin.exe
Size

14KB
MD5

19dbec50735b5f2a72d4199c4e184960
SHA1

6fed7732f7cb6f59743795b2ab154a3676f4c822
SHA256

a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
SHA512

aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d

Score

7^/10

bootkit google persistence phishing

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

MEMZ-Destructive.bin.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation	MEMZ-Destructive.bin.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

MEMZ-Destructive.bin.exe

description ioc process

File opened for modification \??\PhysicalDrive0 MEMZ-Destructive.bin.exe
Detected potential entity reuse from brand google.
phishing google
Drops file in System32 directory 1 IoCs

Processes:

mmc.exe

description ioc process

File opened for modification C:\Windows\System32\devmgmt.msc mmc.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	MEMZ-Destructive.bin.exe

description	ioc	process
File opened for modification	C:\Windows\System32\devmgmt.msc	mmc.exe

Drops file in Windows directory 56 IoCs

Processes:

mmc.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exe

description	ioc	process
File created	C:\Windows\INF\oposdrv.PNF	mmc.exe
File created	C:\Windows\INF\PerceptionSimulationSixDof.PNF	mmc.exe
File created	C:\Windows\INF\c_fscopyprotection.PNF	mmc.exe
File created	C:\Windows\INF\wsdprint.PNF	mmc.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\INF\c_linedisplay.PNF	mmc.exe
File created	C:\Windows\INF\c_extension.PNF	mmc.exe
File created	C:\Windows\INF\c_sslaccel.PNF	mmc.exe
File created	C:\Windows\INF\c_fssystemrecovery.PNF	mmc.exe
File created	C:\Windows\INF\c_fsactivitymonitor.PNF	mmc.exe
File created	C:\Windows\INF\c_barcodescanner.PNF	mmc.exe
File created	C:\Windows\INF\c_fsundelete.PNF	mmc.exe
File created	C:\Windows\INF\c_scmvolume.PNF	mmc.exe
File created	C:\Windows\INF\c_fsopenfilebackup.PNF	mmc.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\INF\c_scmdisk.PNF	mmc.exe
File created	C:\Windows\INF\c_fssystem.PNF	mmc.exe
File created	C:\Windows\INF\c_proximity.PNF	mmc.exe
File created	C:\Windows\INF\c_fsvirtualization.PNF	mmc.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\INF\c_swcomponent.PNF	mmc.exe
File created	C:\Windows\INF\rawsilo.PNF	mmc.exe
File created	C:\Windows\INF\miradisp.PNF	mmc.exe
File created	C:\Windows\INF\c_processor.PNF	mmc.exe
File created	C:\Windows\INF\ramdisk.PNF	mmc.exe
File created	C:\Windows\INF\c_magneticstripereader.PNF	mmc.exe
File created	C:\Windows\INF\c_apo.PNF	mmc.exe
File created	C:\Windows\INF\c_fscontinuousbackup.PNF	mmc.exe
File created	C:\Windows\INF\c_cashdrawer.PNF	mmc.exe
File created	C:\Windows\INF\c_fsencryption.PNF	mmc.exe
File created	C:\Windows\INF\c_fscfsmetadataserver.PNF	mmc.exe
File created	C:\Windows\INF\c_holographic.PNF	mmc.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdge.exe
File created	C:\Windows\INF\c_fsantivirus.PNF	mmc.exe
File created	C:\Windows\INF\c_fshsm.PNF	mmc.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\INF\c_mcx.PNF	mmc.exe
File created	C:\Windows\INF\c_diskdrive.PNF	mmc.exe
File created	C:\Windows\INF\dc1-controller.PNF	mmc.exe
File created	C:\Windows\INF\c_firmware.PNF	mmc.exe
File created	C:\Windows\INF\c_fsreplication.PNF	mmc.exe
File created	C:\Windows\INF\c_monitor.PNF	mmc.exe
File created	C:\Windows\INF\c_fsphysicalquotamgmt.PNF	mmc.exe
File created	C:\Windows\INF\c_volume.PNF	mmc.exe
File created	C:\Windows\INF\c_receiptprinter.PNF	mmc.exe
File created	C:\Windows\INF\c_fscompression.PNF	mmc.exe
File created	C:\Windows\INF\c_fscontentscreener.PNF	mmc.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\INF\c_fsquotamgmt.PNF	mmc.exe
File created	C:\Windows\INF\remoteposdrv.PNF	mmc.exe
File created	C:\Windows\INF\digitalmediadevice.PNF	mmc.exe
File created	C:\Windows\INF\c_netdriver.PNF	mmc.exe
File created	C:\Windows\INF\ts_generic.PNF	mmc.exe
File created	C:\Windows\INF\c_fssecurityenhancer.PNF	mmc.exe
File created	C:\Windows\INF\xusb22.PNF	mmc.exe
File created	C:\Windows\INF\c_fsinfrastructure.PNF	mmc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

mmc.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\ConfigFlags	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\FriendlyName	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\ConfigFlags	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	mmc.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

MicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.google.co.ck	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.google.co.ck\ = "18"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "1015"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 58a35bcdfbc4d701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\Certificates\83DA05A9886F7658B	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = 01000000d699403440a9c35984e693e7c3e9c6477ead32bc57fe104ac53781a03907bf1825247a8a9f293880fb0554f42eadedbab102d755791f5e6e3b75d8feb26fa2b9d18bd41777136399d1e94f2a55222737a7440c8d1479299c65075d6b85d8eb412cf0a60a3c05bc4119b22549bbe781ca92935d610dac03629c0efa93efe2fe96f67168dde1a0107c2080ae14639ebac29a0f329df557333b8daa6071702e0b937f3088c90785e96193729c713de66dd291d80070981cffc61ffc38a27b5a53e5314c99069c52686087aa295dd55e1742eb0e88d6839aa78b5922a8195607d616bfe49adb5ba947073a47efcd1ea8c133f3d16ad2ad71ac52bc3d621b8fd58c8f161ae77e81282c68406905727763e7f4ca41b171af41ac092b6eb085c06462b2b00caec6807098046f30d2b9c82e635faf7e47ab0eaabb3b2dd33871bc54220619dc1eaa6c22b84ba3bb885832abc24ea9a8e703314cce18e68df31b7446df7388a8a891f6dc60a9d52c671d8078ca21b7df760628c7af08aebc01245dd88c8b459294765440de2403a2e813de37bf4bd843998e3bbbeed577c3f87f32d9a79edadf65f0ba88	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\google.co.ck\Total = "1015"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\google.co.ck\Total = "12"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\google.co.ck	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url4 = "https://login.live.com/"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\google.co.ck\Total = "796"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 4d4468aefbc4d701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\google.co.ck\Total = "796"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.google.co.ck\ = "776"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\SmartScreenCompletedVersio = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\google.co.ck	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$WordPress	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows\AllowInPrivate	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\FileVersion = "2016061511"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 8a7f43b4fbc4d701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$blogger	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState\EdpCleanupState = "0"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\ImageStoreRandomFolder = "zaxxdgh"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\google.co.ck\NumberOfSubdomai = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Next Rating Prompt = 10596cbefce5d701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\Certificates\4EEF7FAF0062D34ABE = 0300000001000000140000004eef7faf0062d34abee6137e774438ae9988739f04000000010000001000000024d7172657e6b799f66cf32ae88b5c280f0000000100000020000000547b3c62613c9c2b025d5461623ae703e9853ee45a8bf3b425bf63528e992912140000000100000014000000fe7e60dd9d8292295edf1cf80869a75b98896ed01900000001000000100000002aac2185e0e1b6503eb16a495b1815fc5c0000000100000004000000000800001800000001000000100000002d581a49c8eb5b3b3c6ef9bb65314d702000000001000000eb050000308205e7308203cfa003020102021333000001a636dabe8bbe573d9a0000000001a6300d06092a864886f70d01010b0500307e310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312830260603550403131f4d6963726f736f667420536563757265205365727665722043412032303131301e170d3231303331313139323835325a170d3232303631313139323835325a3081a9310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b130442696e67311b301906035504031312494520496e737472756d656e746174696f6e3127302506092a864886f70d010901161862696e6769657465616d406d6963726f736f66742e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100d0b49f5b650f0fa690df343367a2cd62155e98e3c0fc14cb1f696618be8c327ef257f50d47bce3a4286e36edc0382e0ac81096dbce62463bb552970d01d02a7ca642d6faed9b5878c4e2e33e7c9f94ea4eb7f125662d5d2fe78138ce3e827bd98969028a908fab20632542a1ef952c10382b7efcaae1f5e7521d5fb617a93aa002b579a3203726111c73a9832712e3b5d4d140b247c91824de8123b45ea39fbcdb6e5c77d68cd3db64dd24844a1879865356f655cf1c5d94b208e244bd075a9823c87af7bcad6aab52e3444aad2947a7baad0d42c9d785964dbd8b4e09004359094d0646c3ca98e7c698b0fa7d6f1606b1459fd6df8d9aea8ae85911789bc5e10203010001a38201303082012c300e0603551d0f0101ff0404030204f030150603551d25040e300c060a2b0601040182374c0c01301d0603551d0e04160414fe7e60dd9d8292295edf1cf80869a75b98896ed0301f0603551d230418301680143656896549cb5b9b2f3cac4216504d91b933d79130530603551d1f044c304a3048a046a0448642687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b696f70732f63726c2f4d69635365635365724341323031315f323031312d31302d31382e63726c306006082b0601050507010104543052305006082b060105050730028644687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b696f70732f63657274732f4d69635365635365724341323031315f323031312d31302d31382e637274300c0603551d130101ff04023000300d06092a864886f70d01010b05000382020100c1055e1c6ece899cbff031668bd0b72ee668484f9392c48efe112ba21c521af47582849539f2fd53f7f8adecc243743211150de90b106e6bdaaedb88a8fc71aff2bd4bfeae5628507aa3b47095bf680a0a56bc6cb9c70871fa0b05857bf1762af884469264870c4139f7f9e93bbedaf73a867994c51e7c8473506f1ca68a8f9059cfa5c068be7ecade98315eebd7e71431ebe7d033b4fc8056d94ab70b03e1368082fc83a82cd632b9f3a03f9c9d51881c39b432ee9856e87835bc0481e57489da3590d20b2b9b0900704de861f994d956a2c0347178c59e5048bb9bbfbe8cef237d5860d7f407dcbce486eee7d98a90509a8f1b81445453326b139f0d2fdc68b831681fa96f2284b8153e3dbe60cb2d0ac030d0e2ecfc85c9d361c25e01cabe57cd6ebdc40708b2bd449152e90d2d45d725db856ab64d29a9fdb9fdb85f6354cbd5be240f4b71fa745db8eb32c0e4ea4747bfa5a4f9a5346e42b3379636d05e52225cea1baa7792b8f51b803658026b11fd0ab5877a99f4e74ff994c61177ea425554a7135d8b020661d2d285eb8bf1aa00d3bf78e2f5dba62cd7befdb85fffe6c1b65643f56fe36cf412f366b03bc8c78c852c1ed43a218256636d67eb8241477d3258af4f96b9698b0326d6d01826734eb18f1b393cbf85c0f9fdab4fb854536110f2f678003f80f270cbb1fbeb5ba09523f959dfeba84319577874e4dec0	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 595b51dcfbc4d701	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming\ChangeUnitGenerationNeeded = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\MigrationTime = 25b0743d06c1d701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\google.co.ck\Total = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000	MicrosoftEdgeCP.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

MEMZ-Destructive.bin.exeMEMZ-Destructive.bin.exeMEMZ-Destructive.bin.exeMEMZ-Destructive.bin.exeMEMZ-Destructive.bin.exe

pid	process
1296	MEMZ-Destructive.bin.exe
1296	MEMZ-Destructive.bin.exe
1296	MEMZ-Destructive.bin.exe
1296	MEMZ-Destructive.bin.exe
1296	MEMZ-Destructive.bin.exe
1296	MEMZ-Destructive.bin.exe
1296	MEMZ-Destructive.bin.exe
516	MEMZ-Destructive.bin.exe
1296	MEMZ-Destructive.bin.exe
516	MEMZ-Destructive.bin.exe
372	MEMZ-Destructive.bin.exe
372	MEMZ-Destructive.bin.exe
1296	MEMZ-Destructive.bin.exe
516	MEMZ-Destructive.bin.exe
1296	MEMZ-Destructive.bin.exe
516	MEMZ-Destructive.bin.exe
372	MEMZ-Destructive.bin.exe
372	MEMZ-Destructive.bin.exe
1052	MEMZ-Destructive.bin.exe
1052	MEMZ-Destructive.bin.exe
516	MEMZ-Destructive.bin.exe
1296	MEMZ-Destructive.bin.exe
516	MEMZ-Destructive.bin.exe
1296	MEMZ-Destructive.bin.exe
1996	MEMZ-Destructive.bin.exe
1996	MEMZ-Destructive.bin.exe
1052	MEMZ-Destructive.bin.exe
372	MEMZ-Destructive.bin.exe
1052	MEMZ-Destructive.bin.exe
372	MEMZ-Destructive.bin.exe
1296	MEMZ-Destructive.bin.exe
1296	MEMZ-Destructive.bin.exe
516	MEMZ-Destructive.bin.exe
516	MEMZ-Destructive.bin.exe
1996	MEMZ-Destructive.bin.exe
1996	MEMZ-Destructive.bin.exe
372	MEMZ-Destructive.bin.exe
372	MEMZ-Destructive.bin.exe
1052	MEMZ-Destructive.bin.exe
1052	MEMZ-Destructive.bin.exe
1296	MEMZ-Destructive.bin.exe
1296	MEMZ-Destructive.bin.exe
1052	MEMZ-Destructive.bin.exe
1052	MEMZ-Destructive.bin.exe
372	MEMZ-Destructive.bin.exe
372	MEMZ-Destructive.bin.exe
1996	MEMZ-Destructive.bin.exe
1996	MEMZ-Destructive.bin.exe
516	MEMZ-Destructive.bin.exe
516	MEMZ-Destructive.bin.exe
1996	MEMZ-Destructive.bin.exe
1996	MEMZ-Destructive.bin.exe
372	MEMZ-Destructive.bin.exe
372	MEMZ-Destructive.bin.exe
1296	MEMZ-Destructive.bin.exe
1052	MEMZ-Destructive.bin.exe
1296	MEMZ-Destructive.bin.exe
1052	MEMZ-Destructive.bin.exe
516	MEMZ-Destructive.bin.exe
1052	MEMZ-Destructive.bin.exe
1052	MEMZ-Destructive.bin.exe
516	MEMZ-Destructive.bin.exe
372	MEMZ-Destructive.bin.exe
372	MEMZ-Destructive.bin.exe

Suspicious behavior: MapViewOfSection 8 IoCs

Processes:

MicrosoftEdgeCP.exe

pid	process
1100	MicrosoftEdgeCP.exe
1100	MicrosoftEdgeCP.exe
1100	MicrosoftEdgeCP.exe
1100	MicrosoftEdgeCP.exe
1100	MicrosoftEdgeCP.exe
1100	MicrosoftEdgeCP.exe
1100	MicrosoftEdgeCP.exe
1100	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeAUDIODG.EXEmmc.exe

description	pid	process
Token: SeDebugPrivilege	1372	MicrosoftEdge.exe
Token: SeDebugPrivilege	1372	MicrosoftEdge.exe
Token: SeDebugPrivilege	1372	MicrosoftEdge.exe
Token: SeDebugPrivilege	1372	MicrosoftEdge.exe
Token: SeDebugPrivilege	3980	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3980	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3980	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3980	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3872	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3872	MicrosoftEdgeCP.exe
Token: 33	5056	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5056	AUDIODG.EXE
Token: 33	4320	mmc.exe
Token: SeIncBasePriorityPrivilege	4320	mmc.exe
Token: 33	4320	mmc.exe
Token: SeIncBasePriorityPrivilege	4320	mmc.exe

Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

MEMZ-Destructive.bin.exeMicrosoftEdge.exeMicrosoftEdgeCP.exemmc.exemmc.exe

pid process

4004 MEMZ-Destructive.bin.exe
1372 MicrosoftEdge.exe
1100 MicrosoftEdgeCP.exe
1100 MicrosoftEdgeCP.exe
3972 mmc.exe
4320 mmc.exe
4320 mmc.exe

pid	process
4004	MEMZ-Destructive.bin.exe
1372	MicrosoftEdge.exe
1100	MicrosoftEdgeCP.exe
1100	MicrosoftEdgeCP.exe
3972	mmc.exe
4320	mmc.exe
4320	mmc.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

MEMZ-Destructive.bin.exeMEMZ-Destructive.bin.exeMicrosoftEdgeCP.exe

description	pid	process	target process
PID 1816 wrote to memory of 1296	1816	MEMZ-Destructive.bin.exe	MEMZ-Destructive.bin.exe
PID 1816 wrote to memory of 1296	1816	MEMZ-Destructive.bin.exe	MEMZ-Destructive.bin.exe
PID 1816 wrote to memory of 1296	1816	MEMZ-Destructive.bin.exe	MEMZ-Destructive.bin.exe
PID 1816 wrote to memory of 516	1816	MEMZ-Destructive.bin.exe	MEMZ-Destructive.bin.exe
PID 1816 wrote to memory of 516	1816	MEMZ-Destructive.bin.exe	MEMZ-Destructive.bin.exe
PID 1816 wrote to memory of 516	1816	MEMZ-Destructive.bin.exe	MEMZ-Destructive.bin.exe
PID 1816 wrote to memory of 372	1816	MEMZ-Destructive.bin.exe	MEMZ-Destructive.bin.exe
PID 1816 wrote to memory of 372	1816	MEMZ-Destructive.bin.exe	MEMZ-Destructive.bin.exe
PID 1816 wrote to memory of 372	1816	MEMZ-Destructive.bin.exe	MEMZ-Destructive.bin.exe
PID 1816 wrote to memory of 1052	1816	MEMZ-Destructive.bin.exe	MEMZ-Destructive.bin.exe
PID 1816 wrote to memory of 1052	1816	MEMZ-Destructive.bin.exe	MEMZ-Destructive.bin.exe
PID 1816 wrote to memory of 1052	1816	MEMZ-Destructive.bin.exe	MEMZ-Destructive.bin.exe
PID 1816 wrote to memory of 1996	1816	MEMZ-Destructive.bin.exe	MEMZ-Destructive.bin.exe
PID 1816 wrote to memory of 1996	1816	MEMZ-Destructive.bin.exe	MEMZ-Destructive.bin.exe
PID 1816 wrote to memory of 1996	1816	MEMZ-Destructive.bin.exe	MEMZ-Destructive.bin.exe
PID 1816 wrote to memory of 4004	1816	MEMZ-Destructive.bin.exe	MEMZ-Destructive.bin.exe
PID 1816 wrote to memory of 4004	1816	MEMZ-Destructive.bin.exe	MEMZ-Destructive.bin.exe
PID 1816 wrote to memory of 4004	1816	MEMZ-Destructive.bin.exe	MEMZ-Destructive.bin.exe
PID 4004 wrote to memory of 800	4004	MEMZ-Destructive.bin.exe	notepad.exe
PID 4004 wrote to memory of 800	4004	MEMZ-Destructive.bin.exe	notepad.exe
PID 4004 wrote to memory of 800	4004	MEMZ-Destructive.bin.exe	notepad.exe
PID 1100 wrote to memory of 3980	1100	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1100 wrote to memory of 3980	1100	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1100 wrote to memory of 3980	1100	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1100 wrote to memory of 3980	1100	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1100 wrote to memory of 3980	1100	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1100 wrote to memory of 3980	1100	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1100 wrote to memory of 3980	1100	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1100 wrote to memory of 3980	1100	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1100 wrote to memory of 3980	1100	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1100 wrote to memory of 3980	1100	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1100 wrote to memory of 3980	1100	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1100 wrote to memory of 3980	1100	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1100 wrote to memory of 3980	1100	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1100 wrote to memory of 3980	1100	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1100 wrote to memory of 3980	1100	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1100 wrote to memory of 3980	1100	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1100 wrote to memory of 3980	1100	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1100 wrote to memory of 3980	1100	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1100 wrote to memory of 3980	1100	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1100 wrote to memory of 3980	1100	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1100 wrote to memory of 3980	1100	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1100 wrote to memory of 3980	1100	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1100 wrote to memory of 3980	1100	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1100 wrote to memory of 3980	1100	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1100 wrote to memory of 3980	1100	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1100 wrote to memory of 3980	1100	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1100 wrote to memory of 3020	1100	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1100 wrote to memory of 3020	1100	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1100 wrote to memory of 3020	1100	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1100 wrote to memory of 3020	1100	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1100 wrote to memory of 3020	1100	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1100 wrote to memory of 3020	1100	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1100 wrote to memory of 3020	1100	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1100 wrote to memory of 3020	1100	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1100 wrote to memory of 3020	1100	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1100 wrote to memory of 3020	1100	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1100 wrote to memory of 3020	1100	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1100 wrote to memory of 3020	1100	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1100 wrote to memory of 3020	1100	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1100 wrote to memory of 3020	1100	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1100 wrote to memory of 3020	1100	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1100 wrote to memory of 3020	1100	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1100 wrote to memory of 3020	1100	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe

C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.bin.exe
"C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.bin.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1816

C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.bin.exe
"C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.bin.exe" /watchdog
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1296

C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.bin.exe
"C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.bin.exe" /watchdog
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:516

C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.bin.exe
"C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.bin.exe" /watchdog
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:372

C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.bin.exe
"C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.bin.exe" /watchdog
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1052

C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.bin.exe
"C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.bin.exe" /watchdog
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1996

C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.bin.exe
"C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.bin.exe" /main
2⤵
- Checks computer location settings
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4004

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\System32\notepad.exe" \note.txt
3⤵
PID:800

C:\Windows\SysWOW64\mmc.exe
"C:\Windows\system32\mmc.exe" "C:\Windows\System32\devmgmt.msc"
3⤵
- Suspicious use of SetWindowsHookEx
PID:3972

C:\Windows\system32\mmc.exe
"C:\Windows\System32\devmgmt.msc" "C:\Windows\System32\devmgmt.msc"
4⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4320

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1372

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:1692

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1100

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3980

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3872

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:3020

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4380

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4492

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4756

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3cc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5056

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\GT0TK5T2\cb=gapi[1].js
MD5
3e169f02aacd7376425fb755125c69e7

SHA1
0dd5dcf5274a5b57159ae0a09dd5d61d2b64dd0c

SHA256
1540692f1d2608c1ed7dc523ce638eac9cfb25618aefcd011db034665acc1b59

SHA512
fbc0513e8a9fe21ea7bc6a822d437111ac460d3cc9a65ea15d3ac8918b79a5f23a282c035b90b9210021e48327ca46390346019d43ceebc0d875acd5f0f8efc8

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\GT0TK5T2\googlelogo_color_92x30dp[1].png
MD5
0877987d1be23418318d595a3a297ce9

SHA1
f69e2644e31165bd95311c2ef6d563cfeb1bcc13

SHA256
fd4d9d732e7a4af52746ebabe6bb16941ee71ae3e919131af700cf4e1228a16a

SHA512
780b8db5e9fb5f27ae8e8aff5fe710f2bdab37692e8af19e1f76ca169ede7d988db49cedec92c0fff83a89b1539a2a7c2f6922a7e15979bdfb035f9f1f910641

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\GT0TK5T2\m=DPreE,EufiNb,KG2eXe,L1AAkb,Mbif2,U0aPgd,exgaYe,nabPbb,qcH9Lc,uKlGbf,uxMpU,v7PO8e[2].js
MD5
92b7ce80b2a81a6e104232b4ddae838d

SHA1
fab03e3ecbb655fa6232241f839f7b1be425a04a

SHA256
b90b123be1ea594344494243a9a48126caa3094b39ef5e806384b7b81494cc22

SHA512
e9e7039a0ffd9bba0cea2aba7e6956a2d41b4ab9fb220fe10817c0ce7adaf07a0cff93cc478ddc8a835984f62a61697fb8ee784e1ead350494f9e057219d82dc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\M2MA20MC\m=UFZhBc,VD4Qme,XVaCB,fXO0xe,kQvlef,lpfstd[1].js
MD5
3139c88502966db28f5b15443624a09d

SHA1
9d183784fa7ddd7dc1ecbfd0b9cfcfa9f5b7e62b

SHA256
eb943cea94bd261c2b7c9489216a3b8c24271e16a3d636d3c177bdf1e9ec7d5b

SHA512
2d1e18e1c2332ef85e18d7b311fb54841d2a75b8f1cbc0dc9658326a6c24c9968d449da9405e97f17fef2ab0e3473e83e9478269f9877609fecbc09d7625fd3b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\M2MA20MC\m=aLUfP[2].js
MD5
1be1221d3c03f8c5f139281c7e05d456

SHA1
71165e548ded91fe7c43d32485362748a209e0b6

SHA256
9ecd6a5f319fd3ca5914090e4a443b2a71e5fcdd5a8c11c3ee80ef5c3336d22d

SHA512
f7e7003ee49f21f620c96bfcdb295a8d891f6cb83d063d6c75323222651fca32bd8ccb30030dd4d3acc45dbf31c91f502a9a6de3f5da6244856819e92e0fb219

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\M2MA20MC\nav_logo321[1].png
MD5
4d2f68461740aa8ae4e67a41ab12868c

SHA1
959355e1e8af30b057f14f69b805137fd6d09b68

SHA256
0bf79837e497e65a5c9c06acaa489686f035db0f38ecde4cfa6cc99285da8191

SHA512
c9a208f9da6a4184ca50b2e0639ee31b6573d8893ea80c6422656a8a28e30df86fc3ea55302ba0d8db2d586615c3ee25944b3e2bfeb43dbca9e033e3e88959d4

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\NH20SRDD\JGB3ZjzprIROy7HGB8TmGBfdgUNKVlB6WD4pjBgL73E[1].js
MD5
8825c07432c07be960e8aeb52b7d5bea

SHA1
7114634de6e2f318d0729d3aa3445f88b4856916

SHA256
246077663ce9ac844ecbb1c607c4e61817dd81434a56507a583e298c180bef71

SHA512
aa68534c9714c7ce2f8318771a8c3cbea79bdce07fc34590df9c4ed3323b135fe63305d93416b24896ea0cbae330c209d02baf543db2312e0e9030b58b64d2ff

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\NH20SRDD\desktop_searchbox_sprites318_hr[1].png
MD5
03e471800affd719388000aa2356de1f

SHA1
42e718342bd7f6edf4899e161a77452dcbac68f5

SHA256
bc23b3b207e8fa55b0c65a00f3fed491fa9eb5b1b39d159e7c4921bd331135ec

SHA512
bfa4329d35568f4f50ac2b05917aecb4ad3a4a69f8b7248e6d39cea94f90c231b022c705ed1255f930271db2bf5286f4b24be6756a61e928b0d0723747d40081

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\NH20SRDD\m=CCowhf,Ck63tb,Eox39d,Fkg7bd,HYSCof,HcFEGb,J7ZZy,JGHKP,JKoKVe,MkHyGd,OF7gzc,OZLguc,OqGDve,PymCCe,Rd4mg,T4BAC,Tia57b,TtcOte,UzbKLd,VX3lP,W[1].js
MD5
78bb6506809561c18076471aeeb5197f

SHA1
2bc93dff26cd2270d63323289620811334181558

SHA256
0f3a0365001815b63cecae99215792fdc98a2c0537f8f0310909cb3e54bc3af6

SHA512
9c8330e2bf4681d2b7f8713b72c161ca32f61cefed21037fda70065880481bf9673d557d7345e15da75f2c97c19bb84f0bef61ab0ce6f6520d9fec06b3938daf

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\NH20SRDD\m=CCowhf,EkevXb,GU4Gab,JaEBL,UzbKLd,aa,abd,async,bgd,dvl,fKZehd,foot,kyn,lli,mu,sb_wiz,sf,tl[1].js
MD5
c56e4fd465e9c8d669c5efab1d3da049

SHA1
470558139bf5b97f8b9a44b54c2c23a17d48b6ab

SHA256
b59c320e401a593773088f41b79ae6334ab22a65868a17dee566977c805d0068

SHA512
a6c44c7bf988f848a63d0ce343dca3dffca721697f59f1927c3c3dbaf8492b60e99f8abc87447161b3cf2450dd768ceab3c0a7334e7ba1c36cf8d2edc6cfb03d

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\NH20SRDD\m=CnSW2d,dBuwMe,yuKjYb[2].js
MD5
9ba4a291fe7770aca6f6b35e0823aea6

SHA1
d8061240714be23fe50db76f67cc8b0aafbe258d

SHA256
b9e0e1e09ff091842c6fbd461497389e60150102d0fec5997041697ecc686ed5

SHA512
a19fc016a1258826ec2ec4e48c0b4d61cd7b4865406f3e83b1b83d9bb8b8f4183e9aa39c7ce87f97eff8708804d3e05021beca09edd3d997fcf6464a358b8c1b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\OJNWXTYA\m=Ck63tb,Eox39d,Fkg7bd,HYSCof,HcFEGb,J7ZZy,JGHKP,JKoKVe,K6HGfd,MkHyGd,OF7gzc,OZLguc,OqGDve,PymCCe,Rd4mg,T4BAC,Tia57b,TtcOte,VX3lP,W5mjOc,W[1].js
MD5
7116f4f9b5e179eb47cf3e648e144fab

SHA1
4ab3fe33a4124f13128b5a51c89727321738b416

SHA256
9eb560c0cf367649cf2e2484d8fe426e9153d9d12339de8b94aa6679a2a61c1b

SHA512
698ebf772ab32b9f2f487b6d310735aa3694d8e74e7d29cfa00d608b1c74af5e6f2d3cab222aa9b9c662a390bcde38a026be6dd6017e7551a4bb0f1038f27952

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\OJNWXTYA\m=attn,cdos,cr,dpf,hsm,jsa,d,csi[1].js
MD5
928b6144f7407f8162a76c55202ec04d

SHA1
ac1810ca8c4c5a15049bda5358f8f269eab2a188

SHA256
f09cfca1188c31ed30cddf1bf6e79793623bee77f61e48dd455f91f11795dae2

SHA512
b10069fbc6a201b1af73b90593c2bbaaf7ccd8d383cda59556145096a214710cdd4bd0ba95afb7d65859b61b95cdbc9390f9654da98cda1a89ada62621c7ce0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\OJNWXTYA\rs=AA2YrTsv3hCOYjFRSsPPOakqQhgpvDAQ4g[1].js
MD5
83d244e989ef4be66d2bec6570d66df4

SHA1
12fbd6aebb246e1903b5df15777f1d549230e912

SHA256
ef688c83ae6c00cab134388f9c634d0a00492a53f675f9d5f9863fa71e556711

SHA512
3917a542b961391d94958fd118224485203f9e626059bd2cf9fb1be3cf76aae4e457ebfdf1971e61b1a7f1346b42bd2796349be1f970a92fa5e5a19be35872e2

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\OJNWXTYA\rs=AA2YrTtpwNfv2IuA3ry4lBhfUBS967007g[1].css
MD5
f001c7c3920244dae5acad50ebb74645

SHA1
b06b64b0c40555ab6503ea5418329329ea40445e

SHA256
a9a7a15a577cb112d1e9d53baa3e4abebf2f4e4aa0d15ad0b869a81485aae147

SHA512
a71e55d596d562564ec2f62f9513a5a27b3b5462f9a29e4465b03f8a15e77373d069bbcd85e1db03780a16ea9e1f212f170dc45c5c097d7c98550efc617d5b36

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\48EKESI7\www.google.co[1].xml
MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\48EKESI7\www.google.co[1].xml
MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\48EKESI7\www.google.co[1].xml
MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\48EKESI7\www.google.co[1].xml
MD5
29cbcd91c4d490f00820a56703b79d6d

SHA1
73112c292a1af79d03f9a1307c35a9a4945b5adb

SHA256
1d46885688923404b95b8517f7c95667b737773df17b85d3e370ded67e84583a

SHA512
4c13d5201b9b95f138f1381dae1fcc996ed92edffa8ffafaec183e0fe99fc414094ae89d724e5433840912bc8a99b03a44b7e04585dfe83e6cbebfab166ff191

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\48EKESI7\www.google.co[1].xml
MD5
29cbcd91c4d490f00820a56703b79d6d

SHA1
73112c292a1af79d03f9a1307c35a9a4945b5adb

SHA256
1d46885688923404b95b8517f7c95667b737773df17b85d3e370ded67e84583a

SHA512
4c13d5201b9b95f138f1381dae1fcc996ed92edffa8ffafaec183e0fe99fc414094ae89d724e5433840912bc8a99b03a44b7e04585dfe83e6cbebfab166ff191

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\48EKESI7\www.google.co[1].xml
MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\48EKESI7\www.google.co[1].xml
MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\48EKESI7\www.google.co[1].xml
MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\48EKESI7\www.google.co[1].xml
MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\48EKESI7\www.google.co[1].xml
MD5
a55d049089c11cd89d92a091f4920c56

SHA1
229ccfae081fd4938a6d24ce43d64abe60a1f7c7

SHA256
e51247cbca75a60bdd89b98f6d5839a8cf08597fdc7daadbd5c2644143376504

SHA512
0991ce3c50cb14ebfa4cbfa507ebb273e51c8d7819fee9d6509da32a0144c8aead5f9c5401bb5a6ace19bdfd5fee52dec4e05b2e014cce6691329d3c44d92e74

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\48EKESI7\www.google.co[1].xml
MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\48EKESI7\www.google.co[1].xml
MD5
c196ee54ec73e62894ac8f8f186749a7

SHA1
7bf3e71dcc219c3a7a0f83dd69d30a4693831b5a

SHA256
9fabb0865df4a3fd060328389a06d89adc8994162dc7eb09904762c206c12906

SHA512
dda5ec174d7cecf90291664adc74ff75bb3830ba812b244a9a10cbf7eab510d50f24dd96822e4cea206ac4feeaef076a6053120eab2b00b1e6b1dce2b943f7e5

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\48EKESI7\www.google.co[1].xml
MD5
04ba54693ee8c8d823377c8149b415e5

SHA1
7208c79f41506352bd47e61db307c9427362dddb

SHA256
4555cf82c781b1379dfd2e9f32c12a90ce47b359b385af3b9dbe53d493fbb1d5

SHA512
453268452e189dc7c7f4022f7cb6b2d50e399eb3cb137d7abb024f33be1990efb6b142c2d136b1378d606e79026cafe6fec1dbbf280e499173f7a8d4d0763a8e

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\48EKESI7\www.google.co[1].xml
MD5
31ba0099ed3428514d982c3a45343ebc

SHA1
a5a25950beec78397153d6cabf805679017993c1

SHA256
2c8f57e04dc0d5a8797ff2178cf12f816eeb089f96f68ea05b7ff3f095bc991d

SHA512
db70bbb98b819d82e7680c10c265f1d07cca672f76bded6f7df7942998f5acf3aa9f88c644a490ebfe8570f07b5dcf3f4d83d5cff3333756d0045bd3f70a39eb

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\48EKESI7\www.google.co[1].xml
MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\48EKESI7\www.google.co[1].xml
MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\48EKESI7\www.google.co[1].xml
MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\48EKESI7\www.google.co[1].xml
MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\48EKESI7\www.google.co[1].xml
MD5
6afc34b5858e2d3d455ba3cce65a39a3

SHA1
fd0b47ffe0bd7baf47bd71406304b69d19870211

SHA256
99faa06120f83816d6761749edfe900600da5263adbdb72df8dbba42d379e95f

SHA512
de5ac75a2918fd5264cec4296635a2d0a02d72ee03c45ff4e1f32885d294f55395b501f59077520772c3e35d30d538448dcafb6e4914ebd5971884dddfb45861

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
MD5
696f583f07dba993761882b3f0f70820

SHA1
fe4c5a70a5034f7c8f1029fab0432bff17441fe0

SHA256
0f8d79db111a414cfcbf1648123bb068f686ee4b4708c3fb10563c58ad03cb5c

SHA512
e1629f21dab405915b17e662ab90f06422b2a6d50fac924232ae73ff5378a4dafb1cc0794b7ba88606bf3fb143d174c8047c8b9018f4be8087bcfce061283d23

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_8A6A7E24EA4C3355B6BE43AA2093BF34
MD5
4a30fce5785d78a36ad9e2c4b929583e

SHA1
ebdf2c9af82ed0ebb2cab791ed4ff0dc6ac8a55a

SHA256
cc375f69f617ddd5142c80a28d0e50c348aa6116b7d8bd82fa1ee8b47fd141d2

SHA512
42d9a22f8e209f2e7f0162a7dcebd078699fac83170a992227c652ddc074b5780bbf91bb7e422bdfa23f36e10e7681657a4fa16df465124cc9beab4f8e6277b0

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
MD5
64e9b8bb98e2303717538ce259bec57d

SHA1
2b07bf8e0d831da42760c54feff484635009c172

SHA256
76bd459ec8e467efc3e3fb94cb21b9c77a2aa73c9d4c0f3faf823677be756331

SHA512
8980af4a87a009f1ae165182d1edd4ccbd12b40a5890de5dbaea4dbf3aeb86edffd58b088b1e35e12d6b1197cc0db658a9392283583b3cb24a516ebc1f736c56

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_03B9F16043869DBF8D911BC39F654C35
MD5
69cf97bc0ed81591f150a2bd652db6d5

SHA1
2fadb58b47abae7a419e4cca9c06946251833cfa

SHA256
a0352e195da48de59713a03be10d30043444e30d4b1c87a2426c24ae4ec2a8df

SHA512
84a99e29ed9cc5b7c2047f7c57a97da769367ab1026054b4756c90cdeddd05f41f2e4da208acea2ff4d5b45b9248a04f9e1792fbd6f891c72aed2c501f307187

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_5CDF66E6C848459D1861E65261D5D0AC
MD5
13abd51c318fd70ad5f06d49bf6d8b7a

SHA1
42214f6fd907382ba28e5fefd0b88df85cbfa584

SHA256
6a3751d319c2058348860421c1792aec94bfc728dc64bfd7c9ede6edbc234a31

SHA512
5f981f710e1a7a6a46e844568c6741fb338850278a8116f690769a82351b440db3782fa6d57e5ba8b2c812e94f0458876f6998aef5bf59cefca2656a113e1143

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
MD5
be6eed0dccb74422d39794595cbdbc9a

SHA1
04ff517ef964a930793d9c685f09b47fda0f56f0

SHA256
4d4172b587d0c5ac29aeb82e72dec92662b69c2c60ecabc154f8836665395770

SHA512
86ddfc75607ffae83196eb07ad3f48b825cff76b852c21e5ee0d8a9ae663b4186dd2dedb9b022b6080aec9a5e39dfd724a763756cc18856b7767dcbb990aed46

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_8A6A7E24EA4C3355B6BE43AA2093BF34
MD5
eb6ee14e963ad1712da89dd8fdda654b

SHA1
e35b5851f2925ca19ce3be6f5dad0704c40637a0

SHA256
2590d1a367cf88f53f731f13458ee3ceb7289f7b0ccf6fef69d9fa266fa18cfa

SHA512
25311767c6f727faed174ab8804841e341ab16ca92b8b6f189b2fb8eeeede85e6b9f80233bc7aa07953caebfde8939089f7ce62463d191c348591c518924a52f

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
MD5
3c0ecd2428d113a38f759c8dea934515

SHA1
f7f66499c97006bbff70026f30254efb329b48da

SHA256
0f58286b482dba399c8ba7fae2717aed214d851d103a7cd2ec4025165edd391c

SHA512
d2882288c08b0e2d2c40a65165f72684a5b29c9641085c23e9bee9d05b1dd184c923f0a3d8b7a517a312d253f1c4f7f0d1efe48fa91dcd9f480d415bc9978881

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_03B9F16043869DBF8D911BC39F654C35
MD5
5517cb7881c0d80076cdf15aceceea0e

SHA1
17db6c76724c74517c351ef2d248edb39df963f2

SHA256
e55e222d34c986d10dbe48c46ce3aa8f5b8657d516ae50afd28adecfe6f54d1b

SHA512
0acaf9b15b87bcaaa29f073468bfdcd7719dcf8cde492d9add054e66672de7a980dd9e50714d5577823896f13c6dc4149a7060ba1bda08b8ffe3961132c744c2

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_5CDF66E6C848459D1861E65261D5D0AC
MD5
f86f48cb32ff16289d7d0c213fd0e865

SHA1
adb00d240ce5676512808be0679281171f99ad13

SHA256
7e1fbdc011c21500352d9f0c1b8f3e3c479fbc66d528e0ffe7ce0c6db8d9e998

SHA512
df832f8a5f47f46120d3cfef3fdb98552cdad5d99352f15ffc28fd31abc70b1ddc2af12827d38f1d4580da43afe2386a51c84ab36bba4e97736c6580dadb7ba5

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\Windows\3720402701\2274612954.pri
MD5
0db264b38ac3c5f6c140ba120a7fe72f

SHA1
51aa2330c597e84ed3b0d64bf6b73bf6b15f9d74

SHA256
2f6955b0f5277a7904c59e461bfa6b06c54fece0d7c11f27408fa7a281a4556d

SHA512
3534c243516cef5cee0540d5efd5cde1f378e127e6013b5e309a2e0be8393417bfe458706564b4b955f92132a51e2772c67f9fd90441476cc3512a5d9f910d84

Download Submit
C:\note.txt
MD5
afa6955439b8d516721231029fb9ca1b

SHA1
087a043cc123c0c0df2ffadcf8e71e3ac86bbae9

SHA256
8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270

SHA512
5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf

Download Submit
memory/372-117-0x0000000000000000-mapping.dmp

Download
memory/516-116-0x0000000000000000-mapping.dmp

Download
memory/800-121-0x0000000000000000-mapping.dmp

Download
memory/1052-118-0x0000000000000000-mapping.dmp

Download
memory/1296-115-0x0000000000000000-mapping.dmp

Download
memory/1996-119-0x0000000000000000-mapping.dmp

Download
memory/3972-170-0x0000000000000000-mapping.dmp

Download
memory/4004-120-0x0000000000000000-mapping.dmp

Download
memory/4320-171-0x0000000000000000-mapping.dmp

Download
memory/5056-168-0x000001D45A3D0000-0x000001D45A3D2000-memory.dmp

Filesize
8KB

Download
memory/5056-169-0x000001D45A3D0000-0x000001D45A3D2000-memory.dmp

Filesize
8KB

Download