Analysis
-
max time kernel
206s -
max time network
223s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
22-10-2021 08:37
Static task
static1
Behavioral task
behavioral1
Sample
729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exe
Resource
win10-en-20210920
General
-
Target
729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exe
-
Size
8.6MB
-
MD5
a9f696f6e753202bbb0d5e31d6248f04
-
SHA1
711f0c9cafaeca25675f37de88525153f383c346
-
SHA256
729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8
-
SHA512
3e44bfb295ef9e1512c7b639749afc735827d926c395a21f4fddb0aebe1429ff141f67c3ba9d4e62d6d0aabb73b81cb8685d9428ec54ab34e4328e52b58a583c
Malware Config
Signatures
-
Suspicious use of NtCreateProcessExOtherParentProcess 13 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exedescription pid process target process PID 1408 created 3708 1408 WerFault.exe MicrosoftEdgeCP.exe PID 540 created 620 540 WerFault.exe MicrosoftEdgeCP.exe PID 528 created 1100 528 WerFault.exe MicrosoftEdgeCP.exe PID 2992 created 4732 2992 WerFault.exe MicrosoftEdgeCP.exe PID 6064 created 5372 6064 WerFault.exe MicrosoftEdgeCP.exe PID 6112 created 5532 6112 WerFault.exe MicrosoftEdgeCP.exe PID 5200 created 5716 5200 WerFault.exe MicrosoftEdgeCP.exe PID 520 created 5636 520 WerFault.exe MicrosoftEdgeCP.exe PID 2992 created 4968 2992 WerFault.exe MicrosoftEdgeCP.exe PID 2248 created 4952 2248 WerFault.exe MicrosoftEdgeCP.exe PID 408 created 4964 408 WerFault.exe MicrosoftEdgeCP.exe PID 5284 created 4912 5284 WerFault.exe MicrosoftEdgeCP.exe PID 5544 created 5484 5544 WerFault.exe MicrosoftEdgeCP.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Control Panel\International\Geo\Nation 729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exe -
Loads dropped DLL 28 IoCs
Processes:
729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exepid process 4068 729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exe 4068 729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exe 4068 729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exe 4068 729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exe 4068 729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exe 4068 729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exe 4068 729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exe 4068 729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exe 4068 729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exe 4068 729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exe 4068 729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exe 4068 729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exe 4068 729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exe 4068 729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exe 4068 729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exe 4068 729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exe 4068 729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exe 4068 729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exe 4068 729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exe 4068 729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exe 4068 729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exe 4068 729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exe 4068 729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exe 4068 729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exe 4068 729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exe 4068 729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exe 4068 729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exe 4068 729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exe -
Drops file in Windows directory 20 IoCs
Processes:
MicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exedescription ioc process File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdge.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdgeCP.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdgeCP.exe -
Program crash 13 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 540 620 WerFault.exe MicrosoftEdgeCP.exe 1408 3708 WerFault.exe MicrosoftEdgeCP.exe 528 1100 WerFault.exe MicrosoftEdgeCP.exe 2992 4732 WerFault.exe MicrosoftEdgeCP.exe 6064 5372 WerFault.exe MicrosoftEdgeCP.exe 6112 5532 WerFault.exe MicrosoftEdgeCP.exe 5200 5716 WerFault.exe MicrosoftEdgeCP.exe 520 5636 WerFault.exe MicrosoftEdgeCP.exe 2992 4968 WerFault.exe MicrosoftEdgeCP.exe 2248 4952 WerFault.exe MicrosoftEdgeCP.exe 408 4964 WerFault.exe MicrosoftEdgeCP.exe 5284 4912 WerFault.exe MicrosoftEdgeCP.exe 5544 5484 WerFault.exe MicrosoftEdgeCP.exe -
Checks processor information in registry 2 TTPs 36 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe -
Enumerates system info in registry 2 TTPs 24 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe -
Processes:
browser_broker.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdge.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe -
Modifies registry class 64 IoCs
Processes:
MicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Settings\Cache\Content\CacheLimit = "256000" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "6" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "140" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\SharedCookie_MRACMigrationDone = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\www.youtube.com MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CRLs MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "548" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData\RulesFileNextUpdateDate = "341004661" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\youtube.com\Total = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.youtube.com MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$Discuz! MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.youtube.com MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\Certificates\83DA05A9886F7658 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\discord.com\NumberOfSubdomai = "0" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.youtube.com\ = "0" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\AllComplete = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.youtube.com\ = "6" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\youtube.com\NumberOfSubdomai = "0" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 3b772e60adc6d701 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "2790" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DomStorageState\EdpState = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\www.bing.com MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\www.bing.com\ = "0" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\ManagerHistoryComplete = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingDelete MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\youtube.com\Total = "6" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.youtube.com MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "132" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\InProgressFlags = "0" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\NextUpdateDate = "341624120" MicrosoftEdge.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid process 1408 WerFault.exe 1408 WerFault.exe 1408 WerFault.exe 1408 WerFault.exe 1408 WerFault.exe 1408 WerFault.exe 1408 WerFault.exe 1408 WerFault.exe 1408 WerFault.exe 1408 WerFault.exe 528 WerFault.exe 2992 WerFault.exe 528 WerFault.exe 2992 WerFault.exe 528 WerFault.exe 2992 WerFault.exe 528 WerFault.exe 2992 WerFault.exe 528 WerFault.exe 2992 WerFault.exe 528 WerFault.exe 2992 WerFault.exe 2992 WerFault.exe 528 WerFault.exe 2992 WerFault.exe 528 WerFault.exe 2992 WerFault.exe 528 WerFault.exe 2992 WerFault.exe 528 WerFault.exe 2992 WerFault.exe 528 WerFault.exe 2992 WerFault.exe 528 WerFault.exe 2992 WerFault.exe 528 WerFault.exe 2992 WerFault.exe 528 WerFault.exe 2992 WerFault.exe 528 WerFault.exe 2992 WerFault.exe 528 WerFault.exe 2992 WerFault.exe 528 WerFault.exe 2992 WerFault.exe 528 WerFault.exe 2992 WerFault.exe 528 WerFault.exe 540 WerFault.exe 540 WerFault.exe 540 WerFault.exe 540 WerFault.exe 540 WerFault.exe 540 WerFault.exe 540 WerFault.exe 540 WerFault.exe 540 WerFault.exe 1408 WerFault.exe 540 WerFault.exe 540 WerFault.exe 540 WerFault.exe 540 WerFault.exe 540 WerFault.exe 540 WerFault.exe -
Suspicious behavior: MapViewOfSection 38 IoCs
Processes:
MicrosoftEdgeCP.exepid process 1372 MicrosoftEdgeCP.exe 1372 MicrosoftEdgeCP.exe 1372 MicrosoftEdgeCP.exe 1372 MicrosoftEdgeCP.exe 1372 MicrosoftEdgeCP.exe 1372 MicrosoftEdgeCP.exe 1372 MicrosoftEdgeCP.exe 1372 MicrosoftEdgeCP.exe 1372 MicrosoftEdgeCP.exe 1372 MicrosoftEdgeCP.exe 1372 MicrosoftEdgeCP.exe 1372 MicrosoftEdgeCP.exe 1372 MicrosoftEdgeCP.exe 1372 MicrosoftEdgeCP.exe 1372 MicrosoftEdgeCP.exe 1372 MicrosoftEdgeCP.exe 1372 MicrosoftEdgeCP.exe 1372 MicrosoftEdgeCP.exe 1372 MicrosoftEdgeCP.exe 1372 MicrosoftEdgeCP.exe 1372 MicrosoftEdgeCP.exe 1372 MicrosoftEdgeCP.exe 1372 MicrosoftEdgeCP.exe 1372 MicrosoftEdgeCP.exe 1372 MicrosoftEdgeCP.exe 1372 MicrosoftEdgeCP.exe 1372 MicrosoftEdgeCP.exe 1372 MicrosoftEdgeCP.exe 1372 MicrosoftEdgeCP.exe 1372 MicrosoftEdgeCP.exe 1372 MicrosoftEdgeCP.exe 1372 MicrosoftEdgeCP.exe 1372 MicrosoftEdgeCP.exe 1372 MicrosoftEdgeCP.exe 1372 MicrosoftEdgeCP.exe 1372 MicrosoftEdgeCP.exe 1372 MicrosoftEdgeCP.exe 1372 MicrosoftEdgeCP.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exewmic.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeMicrosoftEdgeCP.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exedescription pid process Token: SeDebugPrivilege 4068 729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exe Token: SeDebugPrivilege 1676 MicrosoftEdge.exe Token: SeDebugPrivilege 1676 MicrosoftEdge.exe Token: SeDebugPrivilege 1676 MicrosoftEdge.exe Token: SeDebugPrivilege 1676 MicrosoftEdge.exe Token: SeDebugPrivilege 3708 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 3708 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 3708 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 3708 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 2288 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 2288 MicrosoftEdgeCP.exe Token: SeIncreaseQuotaPrivilege 3132 wmic.exe Token: SeSecurityPrivilege 3132 wmic.exe Token: SeTakeOwnershipPrivilege 3132 wmic.exe Token: SeLoadDriverPrivilege 3132 wmic.exe Token: SeSystemProfilePrivilege 3132 wmic.exe Token: SeSystemtimePrivilege 3132 wmic.exe Token: SeProfSingleProcessPrivilege 3132 wmic.exe Token: SeIncBasePriorityPrivilege 3132 wmic.exe Token: SeCreatePagefilePrivilege 3132 wmic.exe Token: SeBackupPrivilege 3132 wmic.exe Token: SeRestorePrivilege 3132 wmic.exe Token: SeShutdownPrivilege 3132 wmic.exe Token: SeDebugPrivilege 3132 wmic.exe Token: SeSystemEnvironmentPrivilege 3132 wmic.exe Token: SeRemoteShutdownPrivilege 3132 wmic.exe Token: SeUndockPrivilege 3132 wmic.exe Token: SeManageVolumePrivilege 3132 wmic.exe Token: 33 3132 wmic.exe Token: 34 3132 wmic.exe Token: 35 3132 wmic.exe Token: 36 3132 wmic.exe Token: SeIncreaseQuotaPrivilege 3132 wmic.exe Token: SeSecurityPrivilege 3132 wmic.exe Token: SeTakeOwnershipPrivilege 3132 wmic.exe Token: SeLoadDriverPrivilege 3132 wmic.exe Token: SeSystemProfilePrivilege 3132 wmic.exe Token: SeSystemtimePrivilege 3132 wmic.exe Token: SeProfSingleProcessPrivilege 3132 wmic.exe Token: SeIncBasePriorityPrivilege 3132 wmic.exe Token: SeCreatePagefilePrivilege 3132 wmic.exe Token: SeBackupPrivilege 3132 wmic.exe Token: SeRestorePrivilege 3132 wmic.exe Token: SeShutdownPrivilege 3132 wmic.exe Token: SeDebugPrivilege 3132 wmic.exe Token: SeSystemEnvironmentPrivilege 3132 wmic.exe Token: SeRemoteShutdownPrivilege 3132 wmic.exe Token: SeUndockPrivilege 3132 wmic.exe Token: SeManageVolumePrivilege 3132 wmic.exe Token: 33 3132 wmic.exe Token: 34 3132 wmic.exe Token: 35 3132 wmic.exe Token: 36 3132 wmic.exe Token: SeDebugPrivilege 1408 WerFault.exe Token: SeDebugPrivilege 540 WerFault.exe Token: SeDebugPrivilege 528 WerFault.exe Token: SeDebugPrivilege 2992 WerFault.exe Token: SeShutdownPrivilege 2752 MicrosoftEdgeCP.exe Token: SeCreatePagefilePrivilege 2752 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 6064 WerFault.exe Token: SeDebugPrivilege 6112 WerFault.exe Token: SeDebugPrivilege 5200 WerFault.exe Token: SeDebugPrivilege 520 WerFault.exe Token: SeDebugPrivilege 2992 WerFault.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exepid process 1676 MicrosoftEdge.exe 1372 MicrosoftEdgeCP.exe 1372 MicrosoftEdgeCP.exe 1676 MicrosoftEdge.exe 5356 MicrosoftEdgeCP.exe 1676 MicrosoftEdge.exe 1676 MicrosoftEdge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exe729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exeWerFault.exeMicrosoftEdgeCP.exedescription pid process target process PID 788 wrote to memory of 4068 788 729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exe 729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exe PID 788 wrote to memory of 4068 788 729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exe 729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exe PID 4068 wrote to memory of 2992 4068 729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exe WerFault.exe PID 4068 wrote to memory of 2992 4068 729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exe WerFault.exe PID 2992 wrote to memory of 4964 2992 WerFault.exe cmd.exe PID 2992 wrote to memory of 4964 2992 WerFault.exe cmd.exe PID 4068 wrote to memory of 1564 4068 729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exe cmd.exe PID 4068 wrote to memory of 1564 4068 729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exe cmd.exe PID 4068 wrote to memory of 4668 4068 729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exe cmd.exe PID 4068 wrote to memory of 4668 4068 729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exe cmd.exe PID 4068 wrote to memory of 2408 4068 729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exe cmd.exe PID 4068 wrote to memory of 2408 4068 729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exe cmd.exe PID 1372 wrote to memory of 4732 1372 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1372 wrote to memory of 4732 1372 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1372 wrote to memory of 4732 1372 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4068 wrote to memory of 2176 4068 729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exe cmd.exe PID 4068 wrote to memory of 2176 4068 729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exe cmd.exe PID 1372 wrote to memory of 2752 1372 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1372 wrote to memory of 2752 1372 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1372 wrote to memory of 2752 1372 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1372 wrote to memory of 3708 1372 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1372 wrote to memory of 1100 1372 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1372 wrote to memory of 4732 1372 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4068 wrote to memory of 4292 4068 729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exe cmd.exe PID 4068 wrote to memory of 4292 4068 729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exe cmd.exe PID 4068 wrote to memory of 3132 4068 729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exe wmic.exe PID 4068 wrote to memory of 3132 4068 729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exe wmic.exe PID 1372 wrote to memory of 2752 1372 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1372 wrote to memory of 2752 1372 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1372 wrote to memory of 2752 1372 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1372 wrote to memory of 2752 1372 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1372 wrote to memory of 2752 1372 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1372 wrote to memory of 2752 1372 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1372 wrote to memory of 2752 1372 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1372 wrote to memory of 2752 1372 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1372 wrote to memory of 2752 1372 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1372 wrote to memory of 2752 1372 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1372 wrote to memory of 2752 1372 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1372 wrote to memory of 2752 1372 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1372 wrote to memory of 2752 1372 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1372 wrote to memory of 2752 1372 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1372 wrote to memory of 2752 1372 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1372 wrote to memory of 2752 1372 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1372 wrote to memory of 2752 1372 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1372 wrote to memory of 2752 1372 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1372 wrote to memory of 2752 1372 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1372 wrote to memory of 2752 1372 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1372 wrote to memory of 2752 1372 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1372 wrote to memory of 2752 1372 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1372 wrote to memory of 2752 1372 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1372 wrote to memory of 2752 1372 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1372 wrote to memory of 2752 1372 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1372 wrote to memory of 2752 1372 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1372 wrote to memory of 2752 1372 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1372 wrote to memory of 2752 1372 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4068 wrote to memory of 5324 4068 729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exe cmd.exe PID 4068 wrote to memory of 5324 4068 729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exe cmd.exe PID 4068 wrote to memory of 5944 4068 729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exe cmd.exe PID 4068 wrote to memory of 5944 4068 729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exe cmd.exe PID 1372 wrote to memory of 5372 1372 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1372 wrote to memory of 5532 1372 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1372 wrote to memory of 5636 1372 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1372 wrote to memory of 4968 1372 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1372 wrote to memory of 4952 1372 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exe"C:\Users\Admin\AppData\Local\Temp\729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exe"C:\Users\Admin\AppData\Local\Temp\729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8.exe"2⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls & title MrTools | discord.gg/3Wrwv9EJ9F3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" title MrTools "4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get uuid3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1100 -s 44882⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3708 -s 43602⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4732 -s 42522⤵
- Program crash
- Suspicious use of WriteProcessMemory
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 620 -s 33642⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5372 -s 34362⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5532 -s 40882⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5636 -s 40922⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5716 -s 34162⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4968 -s 40602⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4952 -s 34122⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4964 -s 15362⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4912 -s 41242⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5484 -s 40722⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\System32\DataExchangeHost.exeC:\Windows\System32\DataExchangeHost.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\System32\DataExchangeHost.exeC:\Windows\System32\DataExchangeHost.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\HAB331TI.cookieMD5
0967d3e60e3e21abf85d934d5b0d47c1
SHA121dbc39dbeac87a7163a87a3b39010f5e2d39534
SHA2565714e5208ce3b4cf879fda05827c4049d17b90452fe962d87465c9ce9ff4050e
SHA51243a086a87f3fa55190500d7e07ee57e4548a35ab6c7030d873eb92eac598da279dec6662ff0b569eaa50618ee831424b35c820e2b8b0c00093b7da42dde7944a
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAMD5
a7893fd9f4f37d87d33989071e99753d
SHA1c34d6c867ef4dc290a4398953fb0e9ea37e08fe5
SHA2566aee5d4e5f445219223310bde5bdf1575b8a2c3cf3c9a3e50f50ab57a0bd7609
SHA512e8d9333773bcd56aeec7f21ebda9bbba940ac0d9057b399c4c8e115e01162df752f9827bba30e3ec21090026b1a0809a38b6e642ecb7a343ddbc3521835de2e6
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_8A6A7E24EA4C3355B6BE43AA2093BF34MD5
f41a45519277eddb7a8cfdf110be79d9
SHA1df3d7b4fafa7ac209f93f30aa7c8d822afcbc495
SHA256544315432789843f3eb4c1f1c53328f2830cb585c106f6092ab63357275e417e
SHA51222c3e884c56a315a245ad1755235d44ff89888d5a98136c80bb76799cf7898ab5a774faaeb827e91088ee6078ccd671cf50ea3245d296981839fe8567367eedc
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAMD5
64e9b8bb98e2303717538ce259bec57d
SHA12b07bf8e0d831da42760c54feff484635009c172
SHA25676bd459ec8e467efc3e3fb94cb21b9c77a2aa73c9d4c0f3faf823677be756331
SHA5128980af4a87a009f1ae165182d1edd4ccbd12b40a5890de5dbaea4dbf3aeb86edffd58b088b1e35e12d6b1197cc0db658a9392283583b3cb24a516ebc1f736c56
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAMD5
a0bd4b00c3ae1a2d921e9f9f393fe3f7
SHA133429ad7c384145537d6d2bd339ae929f78442e5
SHA2563a477c577cc0f02b026d0e8044dcf2c454c8d4735964c7c6bb9a22f2746fc919
SHA5122d105d3b3c706ab8c439ac358a3a5b8353f64e7af6d9b1fa1f667ab8969b9574c323ee8abbd589827a2a86a5ada252b08fff8e4d6a9bbd45bd39f2d54856b11a
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_8A6A7E24EA4C3355B6BE43AA2093BF34MD5
d3b677ea97b1248fb653d9524cbf6fac
SHA110f9f8b8dc26f35c9a925bd5b3616c20fa1e0e16
SHA2566e37fd5aad41c160b93075a6e148f56a11fa63a74844b74ca83a0b84a61e36a3
SHA512a98c55f47d1546d65b7d3fb2959a0b0f62fc4b188202e74b4ad1399ad196d262eee25063d8623d46b1fd484caafa9e02c457b0939889e618bcc62f3f41eeb055
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAMD5
c789826729bc63fee97d75b2415c5225
SHA14aed0668318f11d0e450ce9224ef77a597d5de44
SHA256c6c86716903c2aed4aaee04147ef6df7b5df22eeae56477fd6823793decbbf0e
SHA512908b429740c2811e1bf3430c4b2086c7fa9ff8abecc8b841680fc4c54cb20b4fa43889f239471a46f593a9a42b6752e0600acad6e766691352a6afbe51fb10c3
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\Windows\3720402701\2274612954.priMD5
0db264b38ac3c5f6c140ba120a7fe72f
SHA151aa2330c597e84ed3b0d64bf6b73bf6b15f9d74
SHA2562f6955b0f5277a7904c59e461bfa6b06c54fece0d7c11f27408fa7a281a4556d
SHA5123534c243516cef5cee0540d5efd5cde1f378e127e6013b5e309a2e0be8393417bfe458706564b4b955f92132a51e2772c67f9fd90441476cc3512a5d9f910d84
-
C:\Users\Admin\AppData\Local\Temp\_MEI7882\VCRUNTIME140.dllMD5
11d9ac94e8cb17bd23dea89f8e757f18
SHA1d4fb80a512486821ad320c4fd67abcae63005158
SHA256e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e
SHA512aa6afd6bea27f554e3646152d8c4f96f7bcaaa4933f8b7c04346e410f93f23cfa6d29362fd5d51ccbb8b6223e094cd89e351f072ad0517553703f5bf9de28778
-
C:\Users\Admin\AppData\Local\Temp\_MEI7882\_asyncio.pydMD5
3510357b9885a59b08fa557e3baed3ce
SHA13c3289172fabb46cd4839532d7e41087f8ffea29
SHA2563ad5f4bd4361df0c077122a91d180dcf9b68b0249fc6b39edda5dd4ece6f23f1
SHA51286afb38825270f3a65240955432ebc85874ee3e44a1aed564e5160f79fb58162fe2b841dd6e542f942499cfe66c78a264cc3cd7ca13285db0b6ca81d0ed7ec31
-
C:\Users\Admin\AppData\Local\Temp\_MEI7882\_bz2.pydMD5
124678d21d4b747ec6f1e77357393dd6
SHA1dbfb53c40d68eba436934b01ebe4f8ee925e1f8e
SHA2569483c4853ca1da3c5b2310dbdd3b835a44df6066620278aa96b2e665c4b4e86b
SHA5122882779b88ed48af1e27c2bc212ddc7e4187d26a28a90655cef98dd44bc07cc93da5bce2442af26d7825639590b1e2b78bf619d50736d67164726a342be348fa
-
C:\Users\Admin\AppData\Local\Temp\_MEI7882\_ctypes.pydMD5
7ab242d7c026dad5e5837b4579bd4eda
SHA1b3ff01b8b3da2b3a9c37bfffafc4fb9ee957cc0f
SHA2561548506345d220d68e9089b9a68b42a9d796141eb6236e600283951cb206eaa1
SHA5121dd09cf14c87f60b42e5e56d0104154513902c9bfa23eef76a92f4a96c2356b2812dd6eee5e9a74d5ed078ade5f8f6d1f1b01961d7efadfebb543d71c2d31a30
-
C:\Users\Admin\AppData\Local\Temp\_MEI7882\_hashlib.pydMD5
ae32a39887d7516223c1e7ffdc3b6911
SHA194b9055c584df9afb291b3917ff3d972b3cd2492
SHA2567936413bc24307f01b90cac2d2cc19f38264d396c1ab8eda180abba2f77162eb
SHA5121f17af61c917fe373f0a40f06ce2b42041447f9e314b2f003b9bd62df87c121467d14ce3f8e778d3447c4869bf381c58600c1e11656ebda6139e6196262ae17e
-
C:\Users\Admin\AppData\Local\Temp\_MEI7882\_lzma.pydMD5
a77c9a75ed7d9f455e896b8fb09b494c
SHA1c85d30bf602d8671f6f446cdaba98de99793e481
SHA2564797aaf192eb56b32ca4febd1fad5be9e01a24e42bf6af2d04fcdf74c8d36fa5
SHA5124d6d93aa0347c49d3f683ee7bc91a3c570c60126c534060654891fad0391321e09b292c9386fb99f6ea2c2eca032889841fce3cab8957bb489760daac6f79e71
-
C:\Users\Admin\AppData\Local\Temp\_MEI7882\_overlapped.pydMD5
22ac38d86314e8bc4a6f7932223f3594
SHA19582dc938c3cda04628b14f1b2cc87f56796a2e6
SHA256fd9e9467e1353f9dc02143481085f2440f25286d0a4630aa8b1d8919cbb50b8f
SHA512f02a59bd75a8e8d16e12fddea0f902c9ec2331042fe97cc53d1f730af61cfc75e6456728d68b65b2f3464ade058ea31b08c1248410ba21378605ad534d42d27b
-
C:\Users\Admin\AppData\Local\Temp\_MEI7882\_queue.pydMD5
e64538868d97697d62862b52df32d81b
SHA12279c5430032ad75338bab3aa28eb554ecd4cd45
SHA256b0bd6330c525b4c64d036d29a3733582928e089d99909500e8564ae139459c5f
SHA5128544f5df6d621a5ff2ca26da65b49f57e19c60b4177a678a00a5feb130bf0902f780b707845b5a4dd9f12ddb673b462f77190e71cbe358db385941f0f38e4996
-
C:\Users\Admin\AppData\Local\Temp\_MEI7882\_socket.pydMD5
4b2f1faab9e55a65afa05f407c92cab4
SHA11e5091b09fc0305cf29ec2e715088e7f46ccbbd4
SHA256241db349093604ab25405402ba8c4212016657c7e6a10edd3110abeb1cc2e1ba
SHA51268070db39cd14841bcd49db1acf19806b0aa4b4ac4c56518b3a3baddaac1cd533f0b3ef70a378f53d65c0d6c0f745a6102b63303ea7978c79f688c787efe9cc3
-
C:\Users\Admin\AppData\Local\Temp\_MEI7882\_ssl.pydMD5
6f52439450ad38bf940eef2b662e4234
SHA13dea643fac7e10cae16c6976982a626dd59ff64a
SHA25631c95af04a76d3badbdd3970d9b4c6b9a72278e69d0d850a4710f1d9a01618d7
SHA512fdd97e04f4a7b1814c2f904029dfb5cdfcd8a125fce884dcd6fdb09fb8a691963192192f22cf4e9d79dd2598cf097a8764aeec7a79e70a9795250c8ef0024474
-
C:\Users\Admin\AppData\Local\Temp\_MEI7882\_uuid.pydMD5
4b12242f880989cb909246c19616e82f
SHA1df1c6459959b040babf21c2ec2ee765ce6103086
SHA25602e05c2dc07b699fb7e6178526d6f32127e8d9b7aed0720446d186824d4fd1db
SHA5122b3df39d886981fa123420c256a97ce075a4f7c6728a4f0e15615b9b7f3f0bad6cbbf46c4d417afa25ab8cdf50303a1209677827ed4877494cfac8f6494d263e
-
C:\Users\Admin\AppData\Local\Temp\_MEI7882\aiohttp\_frozenlist.cp39-win_amd64.pydMD5
f2454e08f168a9af3b6aabf41c5488e3
SHA13ba72153103db0292c555eba4f43f37bddd43a51
SHA2566a563a4ddc233ed5f01f8635d590366b5a078ac73a28a82d837f24bec23dd14f
SHA5123b2008e5ff3009664d7eeafffc3c8bfe420e337177a3f6926314773d65b6622a09b192e893ec50f0b366f356c9b4768358e352cba96127f85f529ce255eb8c93
-
C:\Users\Admin\AppData\Local\Temp\_MEI7882\aiohttp\_helpers.cp39-win_amd64.pydMD5
6815a1c38a30d6ae70027184c09adccf
SHA1ce5afe856c4445d173c0d524f139d1aed3cc4e65
SHA256399dfeee9a2f8c6a132c2d4d28931f4c6c0f1d1394de54b182a6457d9143a418
SHA512efd4fa17a9611ca4337cc667b164e83745bbc4043c226e684957146c9bc2ba37c892940845ec2ff0142d3fe604654a12bf05022782d0c0c3194e4d109b5ebf4f
-
C:\Users\Admin\AppData\Local\Temp\_MEI7882\aiohttp\_http_parser.cp39-win_amd64.pydMD5
67946fe0102b3555988a8edd321946c0
SHA1a93b16df8e9ccbfe2892e4676f58a695cde9604a
SHA256636a925eb31c3a7de39cb9495613b13570606a0672d3e699cb6983287e0c01e3
SHA512786a4e6c49f77bf6cffce5c98cbc66d518075309dacc4c3df286d3c3bc21f7c0cf7986bf85e374827ec7951c13acdd031e76c336bd1fb4fd265aa03a8a28dfd1
-
C:\Users\Admin\AppData\Local\Temp\_MEI7882\aiohttp\_http_writer.cp39-win_amd64.pydMD5
1a518361de37d98224ff98bf47618ecf
SHA1f81def8f71d203aaf68774f6e1158ccceb5806bc
SHA25684e8b37d6fd0162610deb3c1d4887f70e6447850321eea846f860efc2862704b
SHA5127ffef935ba56e2bbad0c569e63f5d33d83dfc72e10252ee259c6fff9859c4e302405a8c017012a9efa6da40ecc1de1ad3248a89404d8532b78b177a6d2ce305f
-
C:\Users\Admin\AppData\Local\Temp\_MEI7882\aiohttp\_websocket.cp39-win_amd64.pydMD5
5fdb53cff23dc82384c70db00ada94c0
SHA1c52391eadeafe9933682c7dbee182200b0640688
SHA256d1c463b5c7a878ef5358a63bb0ea9e87311fe1f416f762bd18b4888c170c647f
SHA5122d81e2eed6b4f37c4178141a24cf4475d27378a5bad3b6f8af022b185050ee9832de5db31271e5ca6e5e397f2e8a2a36edf9ca7eb6e0a9b918e3e8618c22e60b
-
C:\Users\Admin\AppData\Local\Temp\_MEI7882\base_library.zipMD5
c2c39a352a50e216e45a07748fb7f8c5
SHA1402e720be0212198cdfe659f3061795cac169d7f
SHA256ab34fb921a79e9b635d5dd17f3c1b24456d07e4165defdb3c1d047eff0efdb48
SHA512fb44205528dab11a33fea4c60783d56ecd04f5c02076e9900dc99af5089b56a65b5a8668e92b910479ceb7c822731887810e6e4292787fe7181ddb2060b197c3
-
C:\Users\Admin\AppData\Local\Temp\_MEI7882\libcrypto-1_1.dllMD5
63c4f445b6998e63a1414f5765c18217
SHA18c1ac1b4290b122e62f706f7434517077974f40e
SHA256664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
SHA512aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd
-
C:\Users\Admin\AppData\Local\Temp\_MEI7882\libffi-7.dllMD5
eef7981412be8ea459064d3090f4b3aa
SHA1c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
-
C:\Users\Admin\AppData\Local\Temp\_MEI7882\libssl-1_1.dllMD5
bd857f444ebbf147a8fcd1215efe79fc
SHA11550e0d241c27f41c63f197b1bd669591a20c15b
SHA256b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
SHA5122b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a
-
C:\Users\Admin\AppData\Local\Temp\_MEI7882\multidict\_multidict.cp39-win_amd64.pydMD5
d70507ffb5d2f6d527e32546fd138d0e
SHA13c43e86ac5afa6c4064b17fcaff45be5a2bbb9d3
SHA2569fb82e21ee4f4d37d019b7053e6be4d9eed8c92cd12a3f7211125032c6e8cb22
SHA51215933d164c1df23bfe8960a465b6ceedb34b765861ce8cc53bb87fe37745c59f8ee132891b5dc408278b8ad78d7c098f450291350c2e577436ebf2d49ac53faf
-
C:\Users\Admin\AppData\Local\Temp\_MEI7882\nacl\_sodium.pydMD5
f2f8c186dbb91b3dddf6aa7b44ee05d4
SHA195eb61564c5191e59ca5e359646e9564d77a6f97
SHA256ca83a6731e6d49ccb86d94601b148bd4cc36ad89f9cdaae6eec46481047d13ec
SHA512ae2c2ef8abf304cd9132add4cc2f08c4c5486ad96058351fe101788d014a04cb554dec5fab779f9a2ccb9d13ffac45dca3db89e36de163076e5b4c9ff171738e
-
C:\Users\Admin\AppData\Local\Temp\_MEI7882\psutil\_psutil_windows.cp39-win_amd64.pydMD5
789827bcbae298d8d3223f33228b26af
SHA129de4ad19963292504414196dd3e353084a0e864
SHA256f79f6732ea5a3675312ef4b9506bed8e15aa2d9c722d30d0c96274675aa9dc68
SHA512e4d53c2a31b046862accc33ca1fb3327df10fa92e79556d16ca5dccc132bb0812df9454196554c848644c312c58faa07558382a58b53cf8889e61684cfe14885
-
C:\Users\Admin\AppData\Local\Temp\_MEI7882\python3.DLLMD5
d188e47657686c51615075f56e7bbb92
SHA198dbd7e213fb63e851b76da018f5e4ae114b1a0c
SHA25684cb29052734ec4ad5d0eac8a9156202a2077ee9bd43cabc68e44ee22a74910a
SHA51296ca8c589ab5db5fde72d35559170e938ce283559b1b964c860629579d6a231e1c1a1952f3d08a8af35d1790228ac8d97140b25b9c96d43f45e3398459ae51bc
-
C:\Users\Admin\AppData\Local\Temp\_MEI7882\python39.dllMD5
7e9d14aa762a46bb5ebac14fbaeaa238
SHA1a5d90a7df9b90bdd8a84d7dc5066e4ea64ceb3d9
SHA256e456ef44b261f895a01efb52d26c7a0c7d7d465b647a7b5592708ebf693f12a3
SHA512280f16348df1c0953bbc6f37ff277485351171d0545ebe469bacd106d907917f87584154aec0f193f37322bc93ac5433cd9a5b5c7f47367176e5a8b19bbd5023
-
C:\Users\Admin\AppData\Local\Temp\_MEI7882\select.pydMD5
f8f5a047b98309d425fd06b3b41b16e4
SHA12a44819409199b47f11d5d022e6bb1d5d1e77aea
SHA2565361da714a61f99136737630d50fa4e975d76f5de75e181af73c5a23a2b49012
SHA512f0a96790fcdabf02b452f5c6b27604f5a10586b4bf759994e6d636cc55335026631fa302e209a53f5e454bea03b958b6d662e0be91fa64ce187a7dc5d35a9aa9
-
C:\Users\Admin\AppData\Local\Temp\_MEI7882\unicodedata.pydMD5
87f3e3cf017614f58c89c087f63a9c95
SHA10edc1309e514f8a147d62f7e9561172f3b195cd7
SHA256ba6606dcdf1db16a1f0ef94c87adf580bb816105d60cf08bc570b17312a849da
SHA51273f00f44239b2744c37664dbf2b7df9c178a11aa320b9437055901746036003367067f417414382977bf8379df8738c862b69d8d36c6e6aa0b0650833052c85f
-
C:\Users\Admin\AppData\Local\Temp\_MEI7882\yarl\_quoting_c.cp39-win_amd64.pydMD5
b9dbd65dd477f78e292494852ed9cfb8
SHA1d0c78884460fc4fd9810a00c9cd728629db40da4
SHA256e7af21ec47fa1aea28ecc7516b389102514e9e5720b4af89e7aa48b489d4a500
SHA512ef139107342dbb251079a800f275dce170891b5ea829395b256adebee60cae4e14fc852a58b0f476b4b7d3d87cc180046e691a855e4edc62c1baace6b53ab96b
-
\Users\Admin\AppData\Local\Temp\_MEI7882\VCRUNTIME140.dllMD5
11d9ac94e8cb17bd23dea89f8e757f18
SHA1d4fb80a512486821ad320c4fd67abcae63005158
SHA256e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e
SHA512aa6afd6bea27f554e3646152d8c4f96f7bcaaa4933f8b7c04346e410f93f23cfa6d29362fd5d51ccbb8b6223e094cd89e351f072ad0517553703f5bf9de28778
-
\Users\Admin\AppData\Local\Temp\_MEI7882\_asyncio.pydMD5
3510357b9885a59b08fa557e3baed3ce
SHA13c3289172fabb46cd4839532d7e41087f8ffea29
SHA2563ad5f4bd4361df0c077122a91d180dcf9b68b0249fc6b39edda5dd4ece6f23f1
SHA51286afb38825270f3a65240955432ebc85874ee3e44a1aed564e5160f79fb58162fe2b841dd6e542f942499cfe66c78a264cc3cd7ca13285db0b6ca81d0ed7ec31
-
\Users\Admin\AppData\Local\Temp\_MEI7882\_bz2.pydMD5
124678d21d4b747ec6f1e77357393dd6
SHA1dbfb53c40d68eba436934b01ebe4f8ee925e1f8e
SHA2569483c4853ca1da3c5b2310dbdd3b835a44df6066620278aa96b2e665c4b4e86b
SHA5122882779b88ed48af1e27c2bc212ddc7e4187d26a28a90655cef98dd44bc07cc93da5bce2442af26d7825639590b1e2b78bf619d50736d67164726a342be348fa
-
\Users\Admin\AppData\Local\Temp\_MEI7882\_ctypes.pydMD5
7ab242d7c026dad5e5837b4579bd4eda
SHA1b3ff01b8b3da2b3a9c37bfffafc4fb9ee957cc0f
SHA2561548506345d220d68e9089b9a68b42a9d796141eb6236e600283951cb206eaa1
SHA5121dd09cf14c87f60b42e5e56d0104154513902c9bfa23eef76a92f4a96c2356b2812dd6eee5e9a74d5ed078ade5f8f6d1f1b01961d7efadfebb543d71c2d31a30
-
\Users\Admin\AppData\Local\Temp\_MEI7882\_hashlib.pydMD5
ae32a39887d7516223c1e7ffdc3b6911
SHA194b9055c584df9afb291b3917ff3d972b3cd2492
SHA2567936413bc24307f01b90cac2d2cc19f38264d396c1ab8eda180abba2f77162eb
SHA5121f17af61c917fe373f0a40f06ce2b42041447f9e314b2f003b9bd62df87c121467d14ce3f8e778d3447c4869bf381c58600c1e11656ebda6139e6196262ae17e
-
\Users\Admin\AppData\Local\Temp\_MEI7882\_lzma.pydMD5
a77c9a75ed7d9f455e896b8fb09b494c
SHA1c85d30bf602d8671f6f446cdaba98de99793e481
SHA2564797aaf192eb56b32ca4febd1fad5be9e01a24e42bf6af2d04fcdf74c8d36fa5
SHA5124d6d93aa0347c49d3f683ee7bc91a3c570c60126c534060654891fad0391321e09b292c9386fb99f6ea2c2eca032889841fce3cab8957bb489760daac6f79e71
-
\Users\Admin\AppData\Local\Temp\_MEI7882\_overlapped.pydMD5
22ac38d86314e8bc4a6f7932223f3594
SHA19582dc938c3cda04628b14f1b2cc87f56796a2e6
SHA256fd9e9467e1353f9dc02143481085f2440f25286d0a4630aa8b1d8919cbb50b8f
SHA512f02a59bd75a8e8d16e12fddea0f902c9ec2331042fe97cc53d1f730af61cfc75e6456728d68b65b2f3464ade058ea31b08c1248410ba21378605ad534d42d27b
-
\Users\Admin\AppData\Local\Temp\_MEI7882\_queue.pydMD5
e64538868d97697d62862b52df32d81b
SHA12279c5430032ad75338bab3aa28eb554ecd4cd45
SHA256b0bd6330c525b4c64d036d29a3733582928e089d99909500e8564ae139459c5f
SHA5128544f5df6d621a5ff2ca26da65b49f57e19c60b4177a678a00a5feb130bf0902f780b707845b5a4dd9f12ddb673b462f77190e71cbe358db385941f0f38e4996
-
\Users\Admin\AppData\Local\Temp\_MEI7882\_socket.pydMD5
4b2f1faab9e55a65afa05f407c92cab4
SHA11e5091b09fc0305cf29ec2e715088e7f46ccbbd4
SHA256241db349093604ab25405402ba8c4212016657c7e6a10edd3110abeb1cc2e1ba
SHA51268070db39cd14841bcd49db1acf19806b0aa4b4ac4c56518b3a3baddaac1cd533f0b3ef70a378f53d65c0d6c0f745a6102b63303ea7978c79f688c787efe9cc3
-
\Users\Admin\AppData\Local\Temp\_MEI7882\_ssl.pydMD5
6f52439450ad38bf940eef2b662e4234
SHA13dea643fac7e10cae16c6976982a626dd59ff64a
SHA25631c95af04a76d3badbdd3970d9b4c6b9a72278e69d0d850a4710f1d9a01618d7
SHA512fdd97e04f4a7b1814c2f904029dfb5cdfcd8a125fce884dcd6fdb09fb8a691963192192f22cf4e9d79dd2598cf097a8764aeec7a79e70a9795250c8ef0024474
-
\Users\Admin\AppData\Local\Temp\_MEI7882\_uuid.pydMD5
4b12242f880989cb909246c19616e82f
SHA1df1c6459959b040babf21c2ec2ee765ce6103086
SHA25602e05c2dc07b699fb7e6178526d6f32127e8d9b7aed0720446d186824d4fd1db
SHA5122b3df39d886981fa123420c256a97ce075a4f7c6728a4f0e15615b9b7f3f0bad6cbbf46c4d417afa25ab8cdf50303a1209677827ed4877494cfac8f6494d263e
-
\Users\Admin\AppData\Local\Temp\_MEI7882\aiohttp\_frozenlist.cp39-win_amd64.pydMD5
f2454e08f168a9af3b6aabf41c5488e3
SHA13ba72153103db0292c555eba4f43f37bddd43a51
SHA2566a563a4ddc233ed5f01f8635d590366b5a078ac73a28a82d837f24bec23dd14f
SHA5123b2008e5ff3009664d7eeafffc3c8bfe420e337177a3f6926314773d65b6622a09b192e893ec50f0b366f356c9b4768358e352cba96127f85f529ce255eb8c93
-
\Users\Admin\AppData\Local\Temp\_MEI7882\aiohttp\_helpers.cp39-win_amd64.pydMD5
6815a1c38a30d6ae70027184c09adccf
SHA1ce5afe856c4445d173c0d524f139d1aed3cc4e65
SHA256399dfeee9a2f8c6a132c2d4d28931f4c6c0f1d1394de54b182a6457d9143a418
SHA512efd4fa17a9611ca4337cc667b164e83745bbc4043c226e684957146c9bc2ba37c892940845ec2ff0142d3fe604654a12bf05022782d0c0c3194e4d109b5ebf4f
-
\Users\Admin\AppData\Local\Temp\_MEI7882\aiohttp\_http_parser.cp39-win_amd64.pydMD5
67946fe0102b3555988a8edd321946c0
SHA1a93b16df8e9ccbfe2892e4676f58a695cde9604a
SHA256636a925eb31c3a7de39cb9495613b13570606a0672d3e699cb6983287e0c01e3
SHA512786a4e6c49f77bf6cffce5c98cbc66d518075309dacc4c3df286d3c3bc21f7c0cf7986bf85e374827ec7951c13acdd031e76c336bd1fb4fd265aa03a8a28dfd1
-
\Users\Admin\AppData\Local\Temp\_MEI7882\aiohttp\_http_writer.cp39-win_amd64.pydMD5
1a518361de37d98224ff98bf47618ecf
SHA1f81def8f71d203aaf68774f6e1158ccceb5806bc
SHA25684e8b37d6fd0162610deb3c1d4887f70e6447850321eea846f860efc2862704b
SHA5127ffef935ba56e2bbad0c569e63f5d33d83dfc72e10252ee259c6fff9859c4e302405a8c017012a9efa6da40ecc1de1ad3248a89404d8532b78b177a6d2ce305f
-
\Users\Admin\AppData\Local\Temp\_MEI7882\aiohttp\_websocket.cp39-win_amd64.pydMD5
5fdb53cff23dc82384c70db00ada94c0
SHA1c52391eadeafe9933682c7dbee182200b0640688
SHA256d1c463b5c7a878ef5358a63bb0ea9e87311fe1f416f762bd18b4888c170c647f
SHA5122d81e2eed6b4f37c4178141a24cf4475d27378a5bad3b6f8af022b185050ee9832de5db31271e5ca6e5e397f2e8a2a36edf9ca7eb6e0a9b918e3e8618c22e60b
-
\Users\Admin\AppData\Local\Temp\_MEI7882\libcrypto-1_1.dllMD5
63c4f445b6998e63a1414f5765c18217
SHA18c1ac1b4290b122e62f706f7434517077974f40e
SHA256664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
SHA512aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd
-
\Users\Admin\AppData\Local\Temp\_MEI7882\libcrypto-1_1.dllMD5
63c4f445b6998e63a1414f5765c18217
SHA18c1ac1b4290b122e62f706f7434517077974f40e
SHA256664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
SHA512aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd
-
\Users\Admin\AppData\Local\Temp\_MEI7882\libffi-7.dllMD5
eef7981412be8ea459064d3090f4b3aa
SHA1c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
-
\Users\Admin\AppData\Local\Temp\_MEI7882\libssl-1_1.dllMD5
bd857f444ebbf147a8fcd1215efe79fc
SHA11550e0d241c27f41c63f197b1bd669591a20c15b
SHA256b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
SHA5122b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a
-
\Users\Admin\AppData\Local\Temp\_MEI7882\multidict\_multidict.cp39-win_amd64.pydMD5
d70507ffb5d2f6d527e32546fd138d0e
SHA13c43e86ac5afa6c4064b17fcaff45be5a2bbb9d3
SHA2569fb82e21ee4f4d37d019b7053e6be4d9eed8c92cd12a3f7211125032c6e8cb22
SHA51215933d164c1df23bfe8960a465b6ceedb34b765861ce8cc53bb87fe37745c59f8ee132891b5dc408278b8ad78d7c098f450291350c2e577436ebf2d49ac53faf
-
\Users\Admin\AppData\Local\Temp\_MEI7882\nacl\_sodium.pydMD5
f2f8c186dbb91b3dddf6aa7b44ee05d4
SHA195eb61564c5191e59ca5e359646e9564d77a6f97
SHA256ca83a6731e6d49ccb86d94601b148bd4cc36ad89f9cdaae6eec46481047d13ec
SHA512ae2c2ef8abf304cd9132add4cc2f08c4c5486ad96058351fe101788d014a04cb554dec5fab779f9a2ccb9d13ffac45dca3db89e36de163076e5b4c9ff171738e
-
\Users\Admin\AppData\Local\Temp\_MEI7882\psutil\_psutil_windows.cp39-win_amd64.pydMD5
789827bcbae298d8d3223f33228b26af
SHA129de4ad19963292504414196dd3e353084a0e864
SHA256f79f6732ea5a3675312ef4b9506bed8e15aa2d9c722d30d0c96274675aa9dc68
SHA512e4d53c2a31b046862accc33ca1fb3327df10fa92e79556d16ca5dccc132bb0812df9454196554c848644c312c58faa07558382a58b53cf8889e61684cfe14885
-
\Users\Admin\AppData\Local\Temp\_MEI7882\python3.dllMD5
d188e47657686c51615075f56e7bbb92
SHA198dbd7e213fb63e851b76da018f5e4ae114b1a0c
SHA25684cb29052734ec4ad5d0eac8a9156202a2077ee9bd43cabc68e44ee22a74910a
SHA51296ca8c589ab5db5fde72d35559170e938ce283559b1b964c860629579d6a231e1c1a1952f3d08a8af35d1790228ac8d97140b25b9c96d43f45e3398459ae51bc
-
\Users\Admin\AppData\Local\Temp\_MEI7882\python39.dllMD5
7e9d14aa762a46bb5ebac14fbaeaa238
SHA1a5d90a7df9b90bdd8a84d7dc5066e4ea64ceb3d9
SHA256e456ef44b261f895a01efb52d26c7a0c7d7d465b647a7b5592708ebf693f12a3
SHA512280f16348df1c0953bbc6f37ff277485351171d0545ebe469bacd106d907917f87584154aec0f193f37322bc93ac5433cd9a5b5c7f47367176e5a8b19bbd5023
-
\Users\Admin\AppData\Local\Temp\_MEI7882\select.pydMD5
f8f5a047b98309d425fd06b3b41b16e4
SHA12a44819409199b47f11d5d022e6bb1d5d1e77aea
SHA2565361da714a61f99136737630d50fa4e975d76f5de75e181af73c5a23a2b49012
SHA512f0a96790fcdabf02b452f5c6b27604f5a10586b4bf759994e6d636cc55335026631fa302e209a53f5e454bea03b958b6d662e0be91fa64ce187a7dc5d35a9aa9
-
\Users\Admin\AppData\Local\Temp\_MEI7882\unicodedata.pydMD5
87f3e3cf017614f58c89c087f63a9c95
SHA10edc1309e514f8a147d62f7e9561172f3b195cd7
SHA256ba6606dcdf1db16a1f0ef94c87adf580bb816105d60cf08bc570b17312a849da
SHA51273f00f44239b2744c37664dbf2b7df9c178a11aa320b9437055901746036003367067f417414382977bf8379df8738c862b69d8d36c6e6aa0b0650833052c85f
-
\Users\Admin\AppData\Local\Temp\_MEI7882\yarl\_quoting_c.cp39-win_amd64.pydMD5
b9dbd65dd477f78e292494852ed9cfb8
SHA1d0c78884460fc4fd9810a00c9cd728629db40da4
SHA256e7af21ec47fa1aea28ecc7516b389102514e9e5720b4af89e7aa48b489d4a500
SHA512ef139107342dbb251079a800f275dce170891b5ea829395b256adebee60cae4e14fc852a58b0f476b4b7d3d87cc180046e691a855e4edc62c1baace6b53ab96b
-
memory/1564-174-0x0000000000000000-mapping.dmp
-
memory/2176-185-0x0000000000000000-mapping.dmp
-
memory/2408-180-0x0000000000000000-mapping.dmp
-
memory/2992-172-0x0000000000000000-mapping.dmp
-
memory/3132-187-0x0000000000000000-mapping.dmp
-
memory/3968-195-0x00000282BFC80000-0x00000282BFC82000-memory.dmpFilesize
8KB
-
memory/3968-196-0x00000282BFC80000-0x00000282BFC82000-memory.dmpFilesize
8KB
-
memory/3968-190-0x00000282BFC80000-0x00000282BFC82000-memory.dmpFilesize
8KB
-
memory/3968-191-0x00000282BFC80000-0x00000282BFC82000-memory.dmpFilesize
8KB
-
memory/3968-192-0x00000282BFC80000-0x00000282BFC82000-memory.dmpFilesize
8KB
-
memory/3968-193-0x00000282BFC80000-0x00000282BFC82000-memory.dmpFilesize
8KB
-
memory/3968-194-0x00000282BFC80000-0x00000282BFC82000-memory.dmpFilesize
8KB
-
memory/4068-115-0x0000000000000000-mapping.dmp
-
memory/4292-186-0x0000000000000000-mapping.dmp
-
memory/4668-175-0x0000000000000000-mapping.dmp
-
memory/4964-173-0x0000000000000000-mapping.dmp
-
memory/5048-201-0x0000023948230000-0x0000023948232000-memory.dmpFilesize
8KB
-
memory/5048-202-0x0000023948230000-0x0000023948232000-memory.dmpFilesize
8KB
-
memory/5048-197-0x0000023948230000-0x0000023948232000-memory.dmpFilesize
8KB
-
memory/5048-198-0x0000023948230000-0x0000023948232000-memory.dmpFilesize
8KB
-
memory/5048-199-0x0000023948230000-0x0000023948232000-memory.dmpFilesize
8KB
-
memory/5048-200-0x0000023948230000-0x0000023948232000-memory.dmpFilesize
8KB
-
memory/5048-207-0x0000023948230000-0x0000023948232000-memory.dmpFilesize
8KB
-
memory/5048-208-0x0000023948230000-0x0000023948232000-memory.dmpFilesize
8KB
-
memory/5048-203-0x0000023948230000-0x0000023948232000-memory.dmpFilesize
8KB
-
memory/5048-204-0x0000023948230000-0x0000023948232000-memory.dmpFilesize
8KB
-
memory/5048-205-0x0000023948230000-0x0000023948232000-memory.dmpFilesize
8KB
-
memory/5048-206-0x0000023948230000-0x0000023948232000-memory.dmpFilesize
8KB
-
memory/5324-188-0x0000000000000000-mapping.dmp
-
memory/5944-189-0x0000000000000000-mapping.dmp