Malware Analysis Report

2024-10-19 06:17

Sample ID 220320-rbnbzacah9
Target Patch.exe
SHA256 8139c166d6dbebac912d37fb5d36a8c78a1ce7918ee228e929d98880638a4a08
Tags
prometheus discovery persistence ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

8139c166d6dbebac912d37fb5d36a8c78a1ce7918ee228e929d98880638a4a08

Threat Level: Known bad

The file Patch.exe was found to be: Known bad.

Malicious Activity Summary

prometheus discovery persistence ransomware

Prometheus Ransomware

Checks computer location settings

Checks installed software on the system

Adds Run key to start application

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Enumerates system info in registry

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of SetWindowsHookEx

Modifies Internet Explorer settings

Modifies registry class

Suspicious use of WriteProcessMemory

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

0001-01-01 00:00

Signatures

N/A

Analysis: behavioral3

Detonation Overview

Submitted

2022-03-20 14:01

Reported

2022-03-20 14:14

Platform

win10v2004-en-20220113

Max time kernel

706s

Max time network

714s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Patch.exe"

Signatures

Prometheus Ransomware

ransomware prometheus

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows\CurrentVersion\Run C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Checks installed software on the system

discovery

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\VEGAS\VEGAS Pro 17.0\protein\Protein_x64.4.1.dll C:\Users\Admin\AppData\Local\Temp\Patch.exe N/A
File opened for modification C:\Program Files\VEGAS\VEGAS Pro 17.0\vegas170.exe C:\Users\Admin\AppData\Local\Temp\Patch.exe N/A
File opened for modification C:\Program Files (x86)\Internet Download Manager\Sony Vegas Pro 17.0.0 Build 421 Patch Uninstaller.exe C:\Users\Admin\AppData\Local\Temp\Patch.exe N/A
File created C:\Program Files (x86)\Internet Download Manager\Sony Vegas Pro 17.0.0 Build 421 Patch Uninstalle.ini C:\Users\Admin\AppData\Local\Temp\Patch.exe N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\4e04bed8-612c-47ad-a87f-3d7fe66a1d07.tmp C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20220320140327.pma C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe N/A

Enumerates physical storage devices

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTcbPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\system32\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3864 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\Patch.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3864 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\Patch.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 3156 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 3156 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 4008 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 4008 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 4008 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 4008 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 4008 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 4008 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 4008 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 4008 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 4008 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 4008 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 4008 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 4008 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 4008 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 4008 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 4008 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 4008 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 4008 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 4008 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 4008 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 4008 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 4008 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 4008 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 4008 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 4008 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 4008 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 4008 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 4008 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 4008 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 4008 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 4008 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 4008 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 4008 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 4008 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 4008 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 4008 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 4008 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 4008 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 4008 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 4008 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 4008 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 3200 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 3200 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 4556 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 4556 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 4556 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 4556 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 4556 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 4556 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 4556 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 4556 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 4556 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 4556 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 4556 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 4556 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 4556 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 4556 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 4556 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 4556 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 4556 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 4556 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Patch.exe

"C:\Users\Admin\AppData\Local\Temp\Patch.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://crackingpatching.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xf8,0x108,0x7fff89fa46f8,0x7fff89fa4708,0x7fff89fa4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,15287477923925922518,16453441132531982236,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,15287477923925922518,16453441132531982236,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,15287477923925922518,16453441132531982236,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2976 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15287477923925922518,16453441132531982236,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3800 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15287477923925922518,16453441132531982236,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3816 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2136,15287477923925922518,16453441132531982236,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5168 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15287477923925922518,16453441132531982236,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15287477923925922518,16453441132531982236,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15287477923925922518,16453441132531982236,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15287477923925922518,16453441132531982236,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15287477923925922518,16453441132531982236,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6648 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15287477923925922518,16453441132531982236,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6700 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,15287477923925922518,16453441132531982236,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7296 /prefetch:8

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff791fd5460,0x7ff791fd5470,0x7ff791fd5480

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,15287477923925922518,16453441132531982236,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7296 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2136,15287477923925922518,16453441132531982236,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4276 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2136,15287477923925922518,16453441132531982236,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3584 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,15287477923925922518,16453441132531982236,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2956 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2136,15287477923925922518,16453441132531982236,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4760 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2136,15287477923925922518,16453441132531982236,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6032 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2136,15287477923925922518,16453441132531982236,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5580 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2136,15287477923925922518,16453441132531982236,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7220 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2136,15287477923925922518,16453441132531982236,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5320 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2136,15287477923925922518,16453441132531982236,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7224 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.msn.com udp
US 204.79.197.203:443 api.msn.com tcp
NL 67.26.111.254:80 tcp
NL 67.26.111.254:80 tcp
NL 67.26.111.254:80 tcp
US 8.8.8.8:53 nav.smartscreen.microsoft.com udp
NL 20.73.130.64:443 nav.smartscreen.microsoft.com tcp
US 8.8.8.8:53 smartscreen-prod.microsoft.com udp
IE 20.67.219.150:443 smartscreen-prod.microsoft.com tcp
IE 20.67.219.150:443 smartscreen-prod.microsoft.com tcp
IE 20.67.219.150:443 smartscreen-prod.microsoft.com tcp
US 8.8.8.8:53 crackingpatching.com udp
US 188.114.96.0:443 crackingpatching.com tcp
US 188.114.96.0:443 crackingpatching.com tcp
NL 20.73.130.64:443 nav.smartscreen.microsoft.com tcp
US 8.8.8.8:53 www.bing.com udp
US 204.79.197.200:443 www.bing.com tcp
US 188.114.96.0:443 crackingpatching.com udp
US 8.8.8.8:53 c0.wp.com udp
US 192.0.77.37:443 c0.wp.com tcp
US 8.8.8.8:53 1.gravatar.com udp
US 8.8.8.8:53 2.gravatar.com udp
US 8.8.8.8:53 0.gravatar.com udp
US 192.0.77.37:443 c0.wp.com tcp
US 192.0.77.37:443 c0.wp.com tcp
US 192.0.77.37:443 c0.wp.com tcp
US 192.0.77.37:443 c0.wp.com tcp
US 192.0.77.37:443 c0.wp.com tcp
US 8.8.8.8:53 apis.google.com udp
US 8.8.8.8:53 connect.facebook.net udp
US 8.8.8.8:53 i0.wp.com udp
US 8.8.8.8:53 jetpack.wordpress.com udp
US 8.8.8.8:53 platform.twitter.com udp
US 8.8.8.8:53 s.w.org udp
US 8.8.8.8:53 s0.wp.com udp
US 8.8.8.8:53 v0.wordpress.com udp
NL 142.250.179.142:443 apis.google.com tcp
US 157.240.19.26:443 connect.facebook.net tcp
US 93.184.220.66:443 platform.twitter.com tcp
US 192.0.77.2:443 i0.wp.com tcp
US 8.8.8.8:53 stats.wp.com udp
US 192.0.77.2:443 i0.wp.com tcp
US 192.0.77.2:443 i0.wp.com tcp
US 192.0.77.2:443 i0.wp.com tcp
US 192.0.77.2:443 i0.wp.com tcp
US 192.0.76.3:443 stats.wp.com tcp
US 192.0.77.2:443 i0.wp.com tcp
NL 142.250.179.142:443 apis.google.com udp
US 8.8.8.8:53 dns.google udp
US 8.8.4.4:443 dns.google tcp
US 8.8.4.4:443 dns.google tcp
US 8.8.4.4:443 dns.google udp
US 157.240.19.26:443 connect.facebook.net udp
US 204.79.197.219:443 tcp
US 104.244.42.72:443 tcp
NL 20.73.130.64:443 nav.smartscreen.microsoft.com tcp
NL 20.73.130.64:443 nav.smartscreen.microsoft.com tcp
NL 216.58.208.98:443 tcp
NL 142.251.39.97:443 tcp
N/A 224.0.0.251:5353 udp
NL 20.73.130.64:443 nav.smartscreen.microsoft.com tcp
NL 142.251.39.97:443 udp
US 8.8.4.4:443 dns.google udp
US 204.79.197.219:443 tcp
US 204.79.197.203:443 api.msn.com tcp
NL 23.73.0.135:443 tcp
NL 23.73.0.135:443 tcp
NL 23.73.0.135:443 tcp
US 204.79.197.203:443 api.msn.com tcp
US 204.79.197.200:443 www.bing.com tcp
IE 52.142.114.2:443 tcp
FR 2.22.22.80:443 tcp
NL 65.9.82.63:443 tcp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
FR 2.22.22.80:443 tcp
US 204.79.197.203:443 api.msn.com tcp
US 8.8.8.8:53 dns.google udp
US 204.79.197.219:443 tcp
US 8.8.8.8:53 dns.google udp
NL 104.109.143.5:80 msedge.b.tlu.dl.delivery.mp.microsoft.com tcp
US 8.8.8.8:53 dns.google udp
US 8.8.4.4:443 dns.google tcp
US 8.8.4.4:443 dns.google udp
US 204.79.197.219:443 tcp
US 8.8.8.8:53 dns.google udp

Files

memory/4008-131-0x00007FFFA8EA0000-0x00007FFFA8EA1000-memory.dmp

\??\pipe\LOCAL\crashpad_2776_RZFYBIXUCBICUXQF

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.21\Sigma\Staging

MD5 9ca5eb41a53645be63d247ad8a9a7869
SHA1 2e98b04b5a2efb04d20bc7fe51b05c4e4841205b
SHA256 f67c58a61ddef715b01debc66ddc0e3c365295ac9870328f6b8bdbcb02a6b8c9
SHA512 7dd7d295ccce957490f025eef124b22c809f140a96003126b801bbbdd94eb2115ee59e7d16dd1f020b1d6eaaff66853b9de2cbf7092c1692f40dbe21ab346fd8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.21\Sigma\Other

MD5 c6c7f3ee1e17acbff6ac22aa89b02e4e
SHA1 bdbd0220e54b80b3d2ffbbddadc89bfbb8e64a8b
SHA256 a2f9f27d6938a74979d34484bced535412969c2533dc694bfa667fe81d66d7d4
SHA512 86ed28ffdd00b4a397a20968792fcd30dd4a891a187a7789c00c88b64689b334a11fa087eb54ccee813c181cf891b43184dde7af9a6f33caed2a71e2c445a7b4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.21\Sigma\Social

MD5 976b1cf7e3442f88cd8ba26d3f0965bb
SHA1 b75438dc71de4ac761d94a215ddbffadcd1225b0
SHA256 decde67630f29fc003cb1f2ccbd7371a05079985a9cce93ec93c4fadd8dc5541
SHA512 d0472fed72e1eb0a7747a693a0e654fbe92dd028db3cc42377810d90474dd4099ac981cca333eb52c18e75ed04a1f1f79f3bf5957fe8b16086f1252b3454b8d5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.21\Sigma\Fingerprinting

MD5 a004023825237dadc8f934758ff9eaf2
SHA1 c981a900b5ce63884635cedfe5ba722416021cb2
SHA256 3c4e82aae615a7bed985b4544afecb774b728df1cc9f7561ea25b97482119ef7
SHA512 e49667fca51a6497ccae9b881d679b857c025f2945ab93c9a6769b1c0a632329993daefab6eda9ed70a32a75630d7b3d93dda5acda8ff87ffe5f090ca7b35e4f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.21\Mu\CompatExceptions

MD5 900263477e1368869fbf1be99990c878
SHA1 e56e199aa4119f3cc4c4d46f96daea89bbf9685a
SHA256 7f660d9db521646e9c6510d844b6c6ea26716b620c46f34edaf7ce318a9473e4
SHA512 1035b388b4b00c744824d13c5ef48118d88abbb53e9d76896a2d96a2a127a7739c119e781d7d5f0b8d910e10539c0c502c9f937fc2487747c65e7285f4b1e6d2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.21\Sigma\Entities

MD5 ba60431b366f83677a5bf1a2e4601799
SHA1 83f828c27de5429e25c38c36ba77e069d5c7b2de
SHA256 ab895ef5f75efd49dbb4fcdf7529e50ca622d13433e067bcf8a1f1127a944da3
SHA512 aa9ff0374fb3d4bff7ee5a78dd5ace340da4af1a844f453a40b2723a91b32e6e3f4bd736fb3f3cb210b016109660a7b5cc8440901c6bb410e61530286a4e0200

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.21\Mu\Entities

MD5 0d37c9d98f35f2c6524bd9b874ec93ed
SHA1 87d2d1149db8a1c2d91bc8d2d6e2827d2d8850f5
SHA256 19ce05d2716fae5d0d6e2067a7a624c0fa7f8b02486d9469861fd30cf1c499ac
SHA512 68e73804a144cbe7287c2136ab1986c4e2a97c497d5bfd36ef5db0f1fb1b4a28839d63d83019082ce61af9b42853934888ce05d6b28350742776b97fa310a575

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.21\Sigma\Cryptomining

MD5 4ec1eda0e8a06238ff5bf88569964d59
SHA1 a2e78944fcac34d89385487ccbbfa4d8f078d612
SHA256 696e930706b5d391eb8778f73b0627ffc2be7f6c9a3e7659170d9d37fc4a97b5
SHA512 c9b1ed7b61f26d94d7f5eded2d42d40f3e4300eee2319fe28e04b25cdb6dd92daf67828bff453bf5fc8d7b6ceb58cab319fc0daac9b0050e27a89efe74d2734e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.21\Sigma\Content

MD5 7f077f40c2d1ce8e95faa8fdb23ed8b4
SHA1 2c329e3e20ea559974ddcaabc2c7c22de81e7ad2
SHA256 bda08f8b53c121bbc03da1f5c870c016b06fa620a2c02375988555dd12889cdf
SHA512 c1fb5d40491ae22a155a9bd115c32cbe9dbcba615545af2f1a252475f9d59844763cd7c177f08277d8ef59e873b7d885fda17f2a504d9ec2c181d0f793cb542b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.21\Sigma\Analytics

MD5 4cefbb980962973a354915a49d1b0f4d
SHA1 1d20148cab5cdadb85fad6041262584a12c2745d
SHA256 66de8db363de02974a1471153112e51f014bb05936ce870c433fd9a85b34455a
SHA512 6a088bbc6c40454165ddee3183667d2997dca5fcc8312f69e3c2397e61255e49b5146b24c2c64cd3c8867289e3abfdf1155e47722fdd8276f96d51e8f311d4b0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.21\Sigma\Advertising

MD5 d024831cae8599f0edee70275d99e843
SHA1 69e08b543802b130da5305cbb0140bda5601079c
SHA256 0b75817b9ce2164f52e537c66bbff0fe53024bf9a00fb193efd63fe48f34a978
SHA512 ee1096446f6a17bc3fde9aadb418ca4b2db5132cdde1e429300487aaf4d8b9865a3bbc95d3a3198cde137a6395f69c035b74a72f74edc22a490bccc3320b0b03

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.21\Mu\Other

MD5 cd0395742b85e2b669eaec1d5f15b65b
SHA1 43c81d1c62fc7ff94f9364639c9a46a0747d122e
SHA256 2b4a47b82cbe70e34407c7df126a24007aff8b45d5716db384d27cc1f3b30707
SHA512 4df2ce734e2f7bc5f02bb7845ea801b57dcf649565dd94b1b71f578b453ba0a17c61ccee73e7cff8f23cdd6aa37e55be5cb15f4767ff88a9a06de3623604fbf0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.21\Mu\Social

MD5 152b745da17397ed5a2f3059bb157600
SHA1 47bf4e575ba1acf47dcc99f1800f753b4cc65ef6
SHA256 ef994058a637f7b1b47c31c8670977084d1f86cc21a196920aa87f8ed31e98e8
SHA512 4984a8a46eb452b3c62f2c2ca8c9d999de37c39895ad9a9ed91d12a7731b1cd227f335829f7a6927f19cd8bf4dd7d6749fc853461a46fc97853d5b9e23171d31

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.21\Mu\Fingerprinting

MD5 b51076d21461e00fcbf3dbd2c9e96b2b
SHA1 31311536cf570f2f9c88d21f03a935ac6e233231
SHA256 21a8d3e85d76761a1aab9dca765efef5dfa08d49db037befd91833e4639dd993
SHA512 3e193220ddddc47ecea32a2f777e55faa12c7a8052323455c8d7a89c01048155c77ae009fd0f5bebea89f1fae4a88b6b3ceca4e808064f474ea5b3a9497598cb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.21\Mu\Cryptomining

MD5 8c31feb9c3faaa9794aa22ce9f48bfbd
SHA1 f5411608a15e803afc97961b310bb21a6a8bd5b6
SHA256 6016fd3685046b33c7a2b1e785ac757df20e7c760abe0c27e1b8b0294222421d
SHA512 ba4b5886c04ba8f7a7dbb87e96d639783a5969a245de181cf620b8f536e3ac95bbd910cd2f1f6aae6c3cd70fc1ef6209dc10d2b083ec51861b51d83f95811baa

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.21\Mu\Content

MD5 94c183b842784d0ae69f8aa57c8ac015
SHA1 c5b1ebc2b5c140ccbb21cd377ca18f3c5d0b80cd
SHA256 aa5c4d50684aa478d5982e509cbf1f8347fbc9cc75cb847d54915c16c3a33d25
SHA512 5808ddb81657acf4712fa845c95aacbab32a414ffda3b9d1218637e2d53bd3e0d6b95c872779ead6eaa13b4d2d563494ad5587337958bd17f1e791fad5d822fb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.21\Mu\Analytics

MD5 fad197d6ffd32d1268b9e7e8d13ab32a
SHA1 b0129887a75965bb2ef56a2c39d3231e5b87265d
SHA256 4e446af739e1a06b48a73607e9441bc4aa34ceafd808ff845864408179a4d2c3
SHA512 01d9f588bfa315e316ff0ff4a15a0a49144fd77ee89960882cd528d7f7a277b086667cea2357c3ca2bd16a2b3f4aeb7fcaf473501b499101be68acbe1e0126cb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.21\Mu\Advertising

MD5 4e9962558e74db5038d8073a5b3431aa
SHA1 3cd097d9dd4b16a69efbb0fd1efe862867822146
SHA256 6f81212bd841eca89aa6f291818b4ad2582d7cdb4e488adea98261494bdcd279
SHA512 fcd76bca998afc517c87de0db6ee54e45aa2263fa7b91653ac3adb34c41f3681fbe19d673ae9b24fdf3d53f5af4e4968e603a1eb557207f8860ac51372026b2e

Analysis: behavioral1

Detonation Overview

Submitted

2022-03-20 14:01

Reported

2022-03-20 14:11

Platform

win7-20220311-en

Max time kernel

4294421s

Max time network

375s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Patch.exe"

Signatures

Checks installed software on the system

discovery

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\VEGAS\VEGAS Pro 17.0\vegas170.exe C:\Users\Admin\AppData\Local\Temp\Patch.exe N/A
File opened for modification C:\Program Files (x86)\Internet Download Manager\Sony Vegas Pro 17.0.0 Build 421 Patch Uninstaller.exe C:\Users\Admin\AppData\Local\Temp\Patch.exe N/A
File created C:\Program Files (x86)\Internet Download Manager\Sony Vegas Pro 17.0.0 Build 421 Patch Uninstalle.ini C:\Users\Admin\AppData\Local\Temp\Patch.exe N/A
File opened for modification C:\Program Files\VEGAS\VEGAS Pro 17.0\protein\Protein_x64.4.1.dll C:\Users\Admin\AppData\Local\Temp\Patch.exe N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "263" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "354549932" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{660721C1-A856-11EC-BC86-FAC86927C613} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DOMStorage\crackingpatching.com\Total = "211" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DOMStorage\crackingpatching.com C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DOMStorage\crackingpatching.com\Total = "56" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DOMStorage\crackingpatching.com\Total = "15" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DOMStorage\crackingpatching.com\ = "134" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DOMStorage\crackingpatching.com\Total = "134" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5076033f633cd801 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d8f8b5d2fcdd154fb512d53e64640bcc00000000020000000000106600000001000020000000d73dc585d4d3b5bb9c257337e2caebb37650be829ac4235729bc767097fafb7e000000000e80000000020000200000007172770de9e4bdf31cb86ac87bf11fdbde66610b4ecf31cfe56a09839cf4170890000000b49810151037f024e8e36991066d2c0a6a548460ac7fbab77a32c597691832d1fc2406c86cfbfcc95ee73b61ce99bf055961caef628f8c2ba9999e851998c830bdbfbb64f105f7d2849d8c9b7c6832772fffa039ea1cc6ac2fe976c7360cd11bb8dd26c9ca9ce997248b4bbf8ebf2f4b912eede6f40b7fab5355fff278c1a64ea6d9329d7feaeb65396a3c66a7bde50f4000000050cbc35deb3dc4fc908a12d8b70f3b59be0b32afb761581c1ea61b2d07de6516816b481cfbde3e82ae0895a4bfc5bbcd646cf5c80bf8ce554db5e36460d3f968 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DOMStorage\crackingpatching.com\Total = "82" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DOMStorage\crackingpatching.com\ = "289" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DOMStorage\crackingpatching.com\ = "15" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DOMStorage\crackingpatching.com\Total = "159" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DOMStorage\crackingpatching.com\ = "185" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DOMStorage\crackingpatching.com\ = "289" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DOMStorage\crackingpatching.com\ = "321" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "237" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DOMStorage\crackingpatching.com\Total = "185" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DOMStorage C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DOMStorage\crackingpatching.com\ = "30" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DOMStorage\crackingpatching.com\Total = "289" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DOMStorage\crackingpatching.com\Total = "263" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "134" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "15" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DOMStorage\crackingpatching.com\Total = "321" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "289" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d8f8b5d2fcdd154fb512d53e64640bcc00000000020000000000106600000001000020000000ac87593861cb32c1a6e278b8a6bec62d91ce802dfb43410df76071bd571cee37000000000e8000000002000020000000f4016205d854cb52a7ae3cdd593a7d587bc87509c5f7458bb5140ab6aa5eae8e20000000d41f24e554db2bbf7be1489391642a968f57cd68571831df4261c3e8cd0136814000000003cd18532acdb705b51be8c7b1a7c7c100ec7a9247bc4c906331d69d6d03b3a4a04e03a20002f2ff41e8b380c582006455dbde9b98617948bac7554fe2d0ef9c C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DOMStorage\crackingpatching.com\Total = "108" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "30" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DOMStorage\crackingpatching.com\ = "211" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c00000000000000010000000083ffff0083ffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Patch.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2016 wrote to memory of 664 N/A C:\Users\Admin\AppData\Local\Temp\Patch.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2016 wrote to memory of 664 N/A C:\Users\Admin\AppData\Local\Temp\Patch.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2016 wrote to memory of 664 N/A C:\Users\Admin\AppData\Local\Temp\Patch.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2016 wrote to memory of 664 N/A C:\Users\Admin\AppData\Local\Temp\Patch.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2016 wrote to memory of 768 N/A C:\Users\Admin\AppData\Local\Temp\Patch.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2016 wrote to memory of 768 N/A C:\Users\Admin\AppData\Local\Temp\Patch.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2016 wrote to memory of 768 N/A C:\Users\Admin\AppData\Local\Temp\Patch.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2016 wrote to memory of 768 N/A C:\Users\Admin\AppData\Local\Temp\Patch.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 664 wrote to memory of 1348 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 664 wrote to memory of 1348 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 664 wrote to memory of 1348 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 664 wrote to memory of 1348 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 768 wrote to memory of 1072 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 768 wrote to memory of 1072 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 768 wrote to memory of 1072 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 768 wrote to memory of 1072 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\Patch.exe

"C:\Users\Admin\AppData\Local\Temp\Patch.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://crackingpatching.com/

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://crackingpatching.com/2019/08/idm-crack.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:768 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:664 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 crackingpatching.com udp
US 8.8.8.8:53 crackingpatching.com udp
US 188.114.96.0:443 crackingpatching.com tcp
US 188.114.96.0:443 crackingpatching.com tcp
US 188.114.96.0:443 crackingpatching.com tcp
US 188.114.96.0:443 crackingpatching.com tcp
US 8.8.8.8:53 c0.wp.com udp
US 192.0.77.37:443 c0.wp.com tcp
US 192.0.77.37:443 c0.wp.com tcp
US 192.0.77.37:443 c0.wp.com tcp
US 188.114.96.0:443 crackingpatching.com tcp
US 188.114.96.0:443 crackingpatching.com tcp
US 188.114.96.0:443 crackingpatching.com tcp
US 188.114.96.0:443 crackingpatching.com tcp
US 192.0.77.37:443 c0.wp.com tcp
US 192.0.77.37:443 c0.wp.com tcp
US 192.0.77.37:443 c0.wp.com tcp
US 8.8.8.8:53 i0.wp.com udp
US 192.0.77.2:443 i0.wp.com tcp
US 192.0.77.2:443 i0.wp.com tcp
US 192.0.77.2:443 i0.wp.com tcp
US 192.0.77.2:443 i0.wp.com tcp
US 192.0.77.2:443 i0.wp.com tcp
US 8.8.8.8:53 apis.google.com udp
US 192.0.77.2:443 i0.wp.com tcp
US 8.8.8.8:53 connect.facebook.net udp
NL 142.250.179.142:443 apis.google.com tcp
NL 142.250.179.142:443 apis.google.com tcp
US 157.240.19.26:443 connect.facebook.net tcp
US 8.8.8.8:53 platform.twitter.com udp
US 157.240.19.26:443 connect.facebook.net tcp
US 93.184.220.66:443 platform.twitter.com tcp
US 8.8.8.8:53 stats.wp.com udp
US 192.0.76.3:443 stats.wp.com tcp
US 192.0.76.3:443 stats.wp.com tcp
US 93.184.220.66:443 platform.twitter.com tcp
US 192.0.77.2:443 i0.wp.com tcp
US 192.0.77.37:443 c0.wp.com tcp
US 192.0.77.2:443 i0.wp.com tcp
US 192.0.77.37:443 c0.wp.com tcp
US 192.0.77.37:443 c0.wp.com tcp
US 192.0.77.37:443 c0.wp.com tcp
US 192.0.77.37:443 c0.wp.com tcp
US 192.0.77.37:443 c0.wp.com tcp
US 192.0.77.37:443 c0.wp.com tcp
US 192.0.77.37:443 c0.wp.com tcp
US 192.0.77.2:443 i0.wp.com tcp
US 192.0.77.2:443 i0.wp.com tcp
NL 142.250.179.142:443 apis.google.com tcp
NL 142.250.179.142:443 apis.google.com tcp
US 157.240.19.26:443 connect.facebook.net tcp
US 157.240.19.26:443 connect.facebook.net tcp
US 192.0.76.3:443 stats.wp.com tcp
US 192.0.76.3:443 stats.wp.com tcp
US 192.0.77.2:443 i0.wp.com tcp
US 192.0.77.2:443 i0.wp.com tcp
US 192.0.77.37:443 c0.wp.com tcp
US 192.0.77.37:443 c0.wp.com tcp
US 192.0.77.37:443 c0.wp.com tcp
US 192.0.77.2:443 i0.wp.com tcp
US 192.0.77.2:443 i0.wp.com tcp
US 192.0.77.37:443 c0.wp.com tcp
US 192.0.77.37:443 c0.wp.com tcp
US 8.8.8.8:53 jetpack.wordpress.com udp
US 192.0.78.33:443 jetpack.wordpress.com tcp
US 192.0.78.33:443 jetpack.wordpress.com tcp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
US 188.114.96.0:443 crackingpatching.com tcp
US 188.114.96.0:443 crackingpatching.com tcp
US 188.114.96.0:443 crackingpatching.com tcp
US 188.114.96.0:443 crackingpatching.com tcp
US 8.8.8.8:53 accounts.google.com udp
NL 172.217.168.237:443 accounts.google.com tcp
NL 172.217.168.237:443 accounts.google.com tcp
US 8.8.8.8:53 partner.googleadservices.com udp
NL 216.58.208.98:443 partner.googleadservices.com tcp
NL 216.58.208.98:443 partner.googleadservices.com tcp
NL 216.58.208.98:443 partner.googleadservices.com tcp
NL 216.58.208.98:443 partner.googleadservices.com tcp
US 8.8.8.8:53 s0.wp.com udp
US 8.8.8.8:53 s1.wp.com udp
US 8.8.8.8:53 s2.wp.com udp
US 8.8.8.8:53 1.gravatar.com udp
US 192.0.73.2:443 1.gravatar.com tcp
US 192.0.73.2:443 1.gravatar.com tcp
US 8.8.8.8:53 ssl.gstatic.com udp
US 192.0.77.32:443 s2.wp.com tcp
US 192.0.77.32:443 s2.wp.com tcp
US 192.0.77.32:443 s2.wp.com tcp
US 192.0.77.32:443 s2.wp.com tcp
US 192.0.77.32:443 s2.wp.com tcp
US 192.0.77.32:443 s2.wp.com tcp
US 8.8.8.8:53 tpc.googlesyndication.com udp
US 8.8.8.8:53 public-api.wordpress.com udp
US 192.0.78.23:443 public-api.wordpress.com tcp
NL 142.251.39.97:443 tpc.googlesyndication.com tcp
US 192.0.78.23:443 public-api.wordpress.com tcp
NL 142.251.39.97:443 tpc.googlesyndication.com tcp
US 8.8.8.8:53 www.facebook.com udp
DE 31.13.92.36:443 www.facebook.com tcp
DE 31.13.92.36:443 www.facebook.com tcp
US 8.8.8.8:53 fe0.google.com udp
US 8.8.8.8:53 fe0.google.com udp
NL 142.251.39.97:443 tpc.googlesyndication.com tcp
NL 142.251.39.97:443 tpc.googlesyndication.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

memory/2016-54-0x0000000075D31000-0x0000000075D33000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{6604C061-A856-11EC-BC86-FAC86927C613}.dat

MD5 2c980c58bc243d17c449a2083b109c9a
SHA1 200ea18f8f3a2373fb1164dd37c586aca0505291
SHA256 97d3c97a0f7d900102313558950a4cc9b018c822dd931042bb52b43361e14e9d
SHA512 9628d73b53816035c86c7013a322095d191b4d29c044778c56c8b061540ddb14735d20ee66f195ecf84ccc607411f2d98dbe3c63f23c73624203e12d5a1e74d3

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{660721C1-A856-11EC-BC86-FAC86927C613}.dat

MD5 a25566b67c2048a30fc1331ab1899b77
SHA1 6e8fc3c7833e705b47992bc2c72dfa06306fc4ad
SHA256 cc22e83ac42c461773602b803210054c3d6caf18da0f3fd5f5394e9305fd2593
SHA512 2891a3c70d1a41efcc3c026031c88e7ababf9fce67ea2f42639bdbd3dae3e4f273955b2b9bc801e6e9387d9291a02a0ec2ebe41729477293a7cff6aa63b8cefb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

MD5 48dd8e302005d0f0480d877667d68075
SHA1 c1b023c51ef992c39966f56442c79008d12a3807
SHA256 cbafbca167f4a526d60264cc472290d1e20ba5e2a918f16556b0cf4c660964ee
SHA512 c59b011e7aa7b4a5b083ff4b9477ae65c83eeb5fbdbd63b55b959c49e3e3fa49f243cbaaa1907fccaf58983f1fbfb24769fc59d9fa51897377a3e87568d51943

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

MD5 6e584791f0b9ca25ab4a211456fea2d6
SHA1 9f5ca4f175c1cf36b4edbbe5168d3e8cfb80ea77
SHA256 de80a86808496d1114aab50e023b8b5a8ba64c76617003809e80b8690bfc96d3
SHA512 61daf76781a10417c9b887d5899511957a585676c9069085e703e6f9958e72521f3be6eef05a0f64b688449c68c32afe24d95732e1b73740bf6816253285b5e2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0f8ac222a703a2730b3ae1f6a2a488a1
SHA1 aea25497d2fc368a003ad5a21b1f4513634160de
SHA256 871995d0b0866da9bad7ca0a1c618f85d47c47d3f7ef082574f7ad696fddf2a0
SHA512 bcfb603bbb370ea22c409182126bf79e701a99c6694565871571f9a98fddfaa7b1054442bef50a4ea1d20beb366f3b337492dbb41b982153e316ff1fa989130a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0f8ac222a703a2730b3ae1f6a2a488a1
SHA1 aea25497d2fc368a003ad5a21b1f4513634160de
SHA256 871995d0b0866da9bad7ca0a1c618f85d47c47d3f7ef082574f7ad696fddf2a0
SHA512 bcfb603bbb370ea22c409182126bf79e701a99c6694565871571f9a98fddfaa7b1054442bef50a4ea1d20beb366f3b337492dbb41b982153e316ff1fa989130a

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GC0VJYYE\styles[1].css

MD5 e6fae855021a88a0067fcc58121c594f
SHA1 6299ac3987b5e81725781799dad361d19ac3b99d
SHA256 e50f9ccd2d6582a58ba1879fa578e60d25fea4c5eedc07deafd14482b2403181
SHA512 b67d641ad4dd65063621f73420a52bfe914f25c58c42c08b0a558a429744154901e05e363a358b56f922c0059fbc3822df063cac76ab49e02f100666a46d3f36

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GC0VJYYE\core_style[1].css

MD5 696080ba6a81a1d37f84d5152ee76307
SHA1 2332e963ad7428aba13511e69ed8144738e903b6
SHA256 37ac4091ad3744e2ed138b10d93c971d049c5b8d9e94295b2838ec3e14f79dd2
SHA512 29277e72f05e45f799199c8caef6495a9191eaf3d59bb5db5474f16a395013190e066501e59b448b2ecc11703a56e6e7a32379c9e40352279c9ad5c625260745

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4adc74ddaf3bc1d3ca40389273f87a1a
SHA1 23837f0f4436d4f9e90dd458bc7e102cfa6eaa60
SHA256 8133506d43f99fee10557a0b7fc68b76bdc02aa58fbf3b8f65b782926dbfaa91
SHA512 9701f34acd64fad6c643b963472b70bca987ed8bcb9a1abd650c490fcde31012fbc57e7be240da58e914e3939a703ece53fe3ea015161d92cacceb465069e285

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WJA7A8H7\light_style[1].css

MD5 3bef9144eda63b2d0f6de1da06d01aa4
SHA1 57f47ed0caa3ce49105bb4c3d030bd9653c13295
SHA256 ae35d636d6a7d2e0681190a8f99647091da95a11a36f9b17b9ba3642548ef32b
SHA512 35c6976179691f35de427be974c9d3cc269d6ae021157a16ec51fd6a2604ffbcc114012721406f3f4fbfa3bf4a2c788f2030a6afb9dff3ea9f2226031d1d3d20

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VWB6EIWR\styles[1].css

MD5 e7ab91a282249a8486f48a9309ef5a7f
SHA1 6627e0c566c2034aa76b485a184a49f94fd2e929
SHA256 887fc280cbbc0aceb3fefc55a7dfd8b191128898111138aa6c94bd2d8a5adc44
SHA512 6c998d90f4fee2ccf7427dc50d27148aa50f90bd0bf20c5bb6312ae963f55095197b3e3ab30f3486d0488200095d230f4d4354f83ef03cc4c9df3c87c5376480

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VWB6EIWR\font-awesome.min[1].css

MD5 269550530cc127b6aa5a35925a7de6ce
SHA1 512c7d79033e3028a9be61b540cf1a6870c896f8
SHA256 799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
SHA512 49f4e24e55fa924faa8ad7debe5ffb2e26d439e25696df6b6f20e7f766b50ea58ec3dbd61b6305a1acacd2c80e6e659accee4140f885b9c9e71008e9001fbf4b

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VWB6EIWR\rescue_shortcodes_styles[1].css

MD5 44d973da587f2ad813988b41fbfc2b23
SHA1 df0f314e9aec43a9059265fd060959121300baa1
SHA256 548bbadf154ec47e52b1050b83e2899a75b4902e178a90bb38e8d621a9e22a06
SHA512 add60723db8ddd6650172fabfa72e034a7edd6274003c4cf8ba64a8696dacdc9524d6a66aaee5862108d9a3dfe7b8386d32f567df473cecca027c93c8736df03

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XLIVDEEI\style[1].css

MD5 02ab60e1c0f0f94c94ac2dc5e2efcfb3
SHA1 459cc26d0d566f7ed0a47949fa21be27cedb0bbb
SHA256 23e4a64f2b294b75c2c7b9d4201ab305b5aafead65000d74086e163fdec65330
SHA512 5ad0585ff6e9d0db4cab1a696530215a319014f6b1e8d3e3b12700a44d448eff10cee466bb2ae7509ab484dfb7d68e760a783ffc53c78e218c9e4f1eeb6c6610

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XLIVDEEI\wp-tab-widget[1].css

MD5 403bd0e2968c93a2a364b57f97061409
SHA1 28cc908e4dc96d961a59d11fbb34d3cecd2dea44
SHA256 c5f6a8acadbf51be74fe6144353ea167461dc2847053447b6191f724435d52da
SHA512 2695e16caec79981351b82eaec1e0a1d78fb2ea7ab716665aa10d0319ac7332badc8fc4d41ef8aa5a473f8e2958103eb5d0ac3bdb053ac7ab4827517dec05aff

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WJA7A8H7\scripts[1].js

MD5 b7b34e52042d1d09a25a9ffe0572874f
SHA1 70180d7fce6fdb165b854a211ef57beeb9f3c25e
SHA256 6d5d5639b82f5074dff77948bdae5dfd171e36f0e0fdadb9dbbdf270a87697bb
SHA512 4942d181380b1dc339d1581f28901fc066b1cc07d7c0357bd95ab590a65827c6e8e67dace6c42612ae1ec134ec407c76843294b791f15e3a2fce8e3e25ffe0d8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 bc39260dedd225b38c2e4727e4d443b3
SHA1 b70bd377f67ac9cd105903576d8d9c0e3994760c
SHA256 51381014189d299f71e9ce2a63fb31d39ad438f15c67c32396c12c012abcce22
SHA512 aae48d6e60507890a2c530286f170cd19bf6c7b0475f2754b326655bd7f413c35de7a60304103fe624d4d10f2766dbcfd369ba862aa7fa9fb9a00e1a34231de6

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XLIVDEEI\cp_logo_750_120[1].png

MD5 a3d5da0403e330ce89a149d6e3e5941e
SHA1 458cd996a4abe7efd46b72e3e5ab9f26c0be64b5
SHA256 e50deff6c80e54064ba12d2d2ba1601a3242229a36e571c9f148397b59a96601
SHA512 77f5623f3d404f24215b6a961af794cdcc8a4faa8c73485ec0c7b045fdc53b93749e7daae0bd4cf9eb323bfe03df73658fb04a34f21bb6a82f1b4c94af129762

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 64e9b8bb98e2303717538ce259bec57d
SHA1 2b07bf8e0d831da42760c54feff484635009c172
SHA256 76bd459ec8e467efc3e3fb94cb21b9c77a2aa73c9d4c0f3faf823677be756331
SHA512 8980af4a87a009f1ae165182d1edd4ccbd12b40a5890de5dbaea4dbf3aeb86edffd58b088b1e35e12d6b1197cc0db658a9392283583b3cb24a516ebc1f736c56

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 001d1e43ed650b2f574c0fac966bdaa6
SHA1 cde782638142bdf27e6abb87c7a8ff2251d3df63
SHA256 0732ef0c3931d0fe913f1389e2ef9ad1ed19795a52506f06491505ad9e47ade1
SHA512 2ca3740d8939e7391d07ce8c7c064d0b2fe90be9908224d581c025148cc2da44d99c58721459b286cb979bbbc23b8330ab6f66b22b62bc4d28926bc450199ac0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 7ae623c7982ee7311ae1fb02c0d0c839
SHA1 f4da50040390e3992f7d648d4558fd744ea63a37
SHA256 d392708b3d8fd12426e265bb089783033bfdb14056c5e153f69047db0567b8bf
SHA512 ab8d98722f4125f8a3ce4fd2e84e2648c85aa3e6d3eaa2ff611d01abf6de14037bb1786506c395a57700894fdc589c32e31e09fd558fe59edf5f8d8ae45efe56

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XLIVDEEI\empty[1].gif

MD5 670e806c4af99e830fd4761e1bf59e0c
SHA1 11b533b132f60a6b6afea5a390ed1846e512b5e5
SHA256 64f181e413007885ec94514522705af3921031b28614387c7c76e8796dc30d95
SHA512 23523009a01c50325cda93e43ca607cf656d0a25068435debec1f0f8ac4cac08a461dbc9f1cf097048a1f150814a99d7b04639d4eacfd7c5ae1166f4d221f72f

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WJA7A8H7\collapse[1].js

MD5 fa0cd89ba95a735e4ba66983059e09de
SHA1 bbef9b800e6a64fd05ddde51d6e812b68efe16ef
SHA256 da7ff92b53bfd5c36e2fc1ddcc7b3115c51d10066210598ae0836a3c9d4fdebb
SHA512 97a88fd320b7d90b3818c212124d810117be9b59eb0d5a186191dc1f202363bb91c3d1be7dd815c48c0d8ac3b75eae6f7226c95f1db0c467543f70fd74b185f0

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WJA7A8H7\index[1].js

MD5 cfb428c02811f0cbe515d5f3dca61de6
SHA1 e95f8696fbe29a706e66ccf582b36d9bd650ab9f
SHA256 679e44f9b4bbbc2ad0c4000c1413fd3a88627d83f1cba8ebdac26f81bc7edb78
SHA512 b5088a7e5e42e078116d23f82bbe1f0862c029e69fb68cad655aa73643626af50ca3335ca64d25624a713ee83c79774949fd9ab4bf2ac598ddb0b2174d3fb326

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WJA7A8H7\flexslider-settings[1].js

MD5 d720b8351d1634f84cf275ee93b85cbe
SHA1 72308d9f9134cca632fe70d6f15ef6448ce4eb0e
SHA256 f8aa3de4dc25d13d80cd3b5484ca2e953bad66428bf66db9178f0726a02a05c9
SHA512 e3d06f658d19e637acb035d78faac17d1e22470d88fd519b29abab27648854ee6da0def595bf044eb2a07d1ce7e537f28c6bb1d9969ed20f86bd8e8330d16750

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WJA7A8H7\flexslider[1].js

MD5 9ec3c315b67f434aabc4da58eabc6c3a
SHA1 51b3a7d882f438d53dc69ca5289e92254160c09a
SHA256 0c853c2cc205bafe5d893017b6a03a2acf0f04a11b85f80605514cf0ae540fe6
SHA512 75317411016a28dff4e7a1d68f7b604b7b08e0be90038c3039493123fe2a89ebbfc084e1e15c029cbadcb64efad2a122307957d8ba51e17ef42fff35a8a3922c

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XLIVDEEI\widgets[1].js

MD5 f7f936f48944db7f829585c4368f33ae
SHA1 ef8acacc9365713f78dac17b54b19f02ec61f3e4
SHA256 c9a35e6a04a65ef59009f7f48fda051d802dea8c7814533ba432b6477410c9b0
SHA512 13071e1ba2972d32c76f089b842357b371256a31f5269c371debd2ba5a3a4d4a32763dba1cea78a80ab106baf060ad61be05d983aeae5d8e41e8ab2715b3af56

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GC0VJYYE\scroll-to-top[1].js

MD5 3f8eb0d7253bbb941ac8d7f53bd44f55
SHA1 7b33e124249f4a126b644f5c5cda8c7db7e24b5c
SHA256 398d8cfc31c237a9cbabb70297adea13ede6d1942f41564484ad3b36366280eb
SHA512 c28fb8e44cb0b2dcfe8cc1d3d3807e6b51cbdeeb877f7246b66d0d0b87f7ee1ec00f6ad3510fa0599f2b43d2ff433af99303224fc03f772c9ba934a6ff617401

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GC0VJYYE\placeholders[1].js

MD5 b8a2edb156c147c3164f7faf6efc9f44
SHA1 0b23deffad7cac9066bc216213b666ccbcb13279
SHA256 babf6fd29c079790cc4d522f66f21af7c099e981080ddf11b5344b12b904e8a5
SHA512 32db87184d754e978adb265d9bd22705c6789e7568b915a9ba02607e79aa8864134b85d30cb9a9dd31beccd24293b7e91586a648d0fdc81142f67f9338b622bd

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GC0VJYYE\menubox[1].js

MD5 0ceb7fdfd175630e54f8f577c4f55829
SHA1 c409b73221fad57ef87bf569bc0c569c2cdd03dd
SHA256 722525e6b4c4bfd8f56df82b47493b8605cfa70a2f4f1622cffc16a1f5720f00
SHA512 1591a5123dfbe9262207f304c0da8d2459193d823607b0a25b9a2e160ed14ccbd5b2294ec4e48563191d6baa637c38c9217b779e1da749a1c3bd9aa14922936d

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GC0VJYYE\selectnav[1].js

MD5 4ac691a8750166ef39610b0ca9c244a5
SHA1 de77738a45f5f1a510a326af6ffba7e12995071f
SHA256 d24943e348d272c8652cc0bf7aee31d381e3bb64b7ec68aa5c45be32fde3215d
SHA512 199795b9b1fd5569f73d79a5eacd01714f223a642eb54f1fe5d4c7c1ee231c6f76cec8adb5a64efede465d9991d1f22200337e7cfdb0b6a10b22db3e4b61c1a1

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GC0VJYYE\responsive[1].js

MD5 fd91b3731d59affcf6389c5f8485bb42
SHA1 e2223595bb2f07bc570a68eb30c7a579c76657bd
SHA256 1e35d5977c584219d4f907b3bf7a4f44ce9acf6b96ad80a24241ed38ea82d4c9
SHA512 713ec8d01218c970acec634b3184990d994e546e4625c99ded7436f9c157cc944c62b199ef345f109b19d9c9db3025adcec8807b9a579b3c0b95ecb472a5339e

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GC0VJYYE\wp-tab-widget[1].js

MD5 8ae93127f7153c16b2cbeadb13620d6b
SHA1 a9bad5ad82aaeeed6753bec8516b77cf54906739
SHA256 50c4d7272e549018e545351ed1557c61c0aea6f311fcc84250b15db2b71ed678
SHA512 86d6ae1d31af2cc1bc258eb85d2be4a8e7235610525bdd72b92b06c797a3d42174e221c72ad063259cb534c884e62db8c5bf486df5a8b937c952d5e6375825bf

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5e8fcba962b14a85477e748486441ca2
SHA1 917cd36e10cddf4fc4c715f2c9ca435264ad63d4
SHA256 73ab4a58d05aee31997a87f964214b5d44cf90a3885c6c60e30f13f96307de8c
SHA512 7baccd3c4f57ccbaf684b895e9e74797b6dc02c2fd4aec6a029721aa164fbbdc7abeecdae90d07ee5bd914982946d5509a6644849f33f12f18062cc7936c5b7b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_411E57A3CF51F4D36709C7598E8BC5BA

MD5 119d7f8548c3c5c5b4a74cf396b713e4
SHA1 19684439085bbbc3e7031e2817d253f9ae9e5cf1
SHA256 707c0453ea0c8491fe3891073283318d64ebe16db001fa51e995eec49deb9c14
SHA512 763fd0ab1d31d0701ac136045593f5b11ffe2b49aa7601d1f2091afcf209c89a08e415ab9aa09429e718afc4f948398b25537c5ade1dd0550a1d5e463a9d6c6d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_411E57A3CF51F4D36709C7598E8BC5BA

MD5 d931bc94860e195bbc0ec52b9f6fdf4a
SHA1 a48505eba3f4b44e15df3f44ef9902f7f094a317
SHA256 4dd195a648b5f308348b8716cbd4ff0f32d288ce983d15cfdab103a9ed59d2a8
SHA512 afbbc0fb947455bb11a133d90f6032507b958456232383d6cf3f378d51be6e7d90e4ed36b75ffcf3dd0fb0a0768a542ca76533435a069b5d8ea47a6cf058d93a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 414f0c377d762392694a5d62e4e1462e
SHA1 211ae34c527c411cf5fae681cbfdc3664742605c
SHA256 e2d6cedf538e7e59db198dd83a4fe93a8d70a3cb3fcc46bbd0d7074725c2e2e0
SHA512 b332d3f8c60214d0a3ab611fbe4aeccfc60acd467557c80b2f2ce1dd89e4219562b6df7db11ad8cc6e5d57c20f82e02ee789be0a92065acf102a3bce684af543

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_DD6D1E8A2E2BB11DAF1C275E703C0791

MD5 7a036bccb50dfa8f8d9b2d1c3e191d9d
SHA1 ed01b4b6085a8b816d2f98bed92034317e09fdcd
SHA256 a6e51568bc7af9792c55f49b9df2fb40920280e8699ef966682e5255fd63f957
SHA512 7decab43b53737f8b2601aeb01a2c076c777d149c5c56a48fd8394c4f8ab7bc8b112ff6e7465ccffefb9b7a33b6ad4ab3f868e0719a3b656226aa7bfba89b6f9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_DD6D1E8A2E2BB11DAF1C275E703C0791

MD5 bbe18fa84e0ef8ccbdba0f549c9e2dba
SHA1 99390b996c14e3187ee76365530f63044a166c66
SHA256 95537d17746ef548db8846d200cd4a45bb51297cc70e4152b845dbd2a5c50554
SHA512 497bb60767b316b5c53f94fb380fe1111d04bc0650639f1b602af44f3f2424c2e09fdd97b6ac9f195ca9176be5cbe591e677a00596d7239a042f2a89afaf5eac

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_9D8EAD474C2F772AA0EF6DA160946E46

MD5 6ea5dab901f13f0b4d6c590f2156c5f2
SHA1 039901c1af6d2e2f4fb788d83b3964adfa7ed0e0
SHA256 50d4b7ec99e3411bc366ca3fb78758d0965f0b8fd60a2c9c57bd674827dacf86
SHA512 b55570fa044b15d0c376de9ca5e7a4772b4455a3373b635d272b53b16d99d9f43804922b509e40119ef8348a358272ada5dd18f7fa9bbb99f4ed30d80dc634dc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_9D8EAD474C2F772AA0EF6DA160946E46

MD5 e249c912eddb82f3e5c267857f4a7a15
SHA1 83b1208393e420596ac52411e365c89561f0f0fa
SHA256 8417abfa8cdde56f695679522d13979daca874ef2119b70a06651ab1b5434f9f
SHA512 232306e3baea1179db851348076c01e537594de1619b8898e2a0b6f452212a88c689ba52242a85dc17dee496374070a04ce7bf56a2eaba196bd05b97ce2d58af

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b12d7ac8f1cd845047830e44a1e3cb4d
SHA1 b5df93c77fd9836ecdeec832f7c60ea7403accac
SHA256 94d3d5b4e6f7440376b57e5f8ac8d984e292662b9554d8b56cad0c868c0e8ec9
SHA512 63b0051b15cd12aae1cc269d072c4ccc6e65514ccbe60ec73165d10135c0791c96cad3b4efa6eda690f73734dbc7550a4e52e8d6d3b270e370ec4c0b31fa8d40

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

MD5 40f186fd55b11cd161e3ba0ed9dc3462
SHA1 109b9738a94314e92980da5c6a921022c00e7ce2
SHA256 283b951633d1f5673f979f98bc21c80b9a7d765539b4604b51e55b9531fb27a0
SHA512 1a4336644719eeb9ddaacf3ae6c254e00b90aad3db6e6156e58da000bb34e80922c7e0f9b2ee6430c6f04aeb9d9ed8f463d29a9f121601356ce03a899dcb5e05

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

MD5 0f4e033169a87e8e9d8138138cfdc242
SHA1 dfdf2ffa17818b24ecae13b95b60e6834cd9db8a
SHA256 c42c120752a935f28a30afced12b72ec5ec61b9693b4a4e1a8e2042ec1f3993b
SHA512 e0486fb2470f1218086ade306b7b1e1c5dad825ba8eb169867c7055867963b424a9d266c58fdb284bcc8c00c8f1752a35a71f0616cfd57c5321a1c0a77b0f832

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

MD5 40f186fd55b11cd161e3ba0ed9dc3462
SHA1 109b9738a94314e92980da5c6a921022c00e7ce2
SHA256 283b951633d1f5673f979f98bc21c80b9a7d765539b4604b51e55b9531fb27a0
SHA512 1a4336644719eeb9ddaacf3ae6c254e00b90aad3db6e6156e58da000bb34e80922c7e0f9b2ee6430c6f04aeb9d9ed8f463d29a9f121601356ce03a899dcb5e05

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

MD5 0f4e033169a87e8e9d8138138cfdc242
SHA1 dfdf2ffa17818b24ecae13b95b60e6834cd9db8a
SHA256 c42c120752a935f28a30afced12b72ec5ec61b9693b4a4e1a8e2042ec1f3993b
SHA512 e0486fb2470f1218086ade306b7b1e1c5dad825ba8eb169867c7055867963b424a9d266c58fdb284bcc8c00c8f1752a35a71f0616cfd57c5321a1c0a77b0f832

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

MD5 40f186fd55b11cd161e3ba0ed9dc3462
SHA1 109b9738a94314e92980da5c6a921022c00e7ce2
SHA256 283b951633d1f5673f979f98bc21c80b9a7d765539b4604b51e55b9531fb27a0
SHA512 1a4336644719eeb9ddaacf3ae6c254e00b90aad3db6e6156e58da000bb34e80922c7e0f9b2ee6430c6f04aeb9d9ed8f463d29a9f121601356ce03a899dcb5e05

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

MD5 1edaafc14da2f840a735c984e746076f
SHA1 63baeed720a26a74927622dc400a990adfd551e0
SHA256 9c74ab18178948a9a0bef4ea424e2dd79d00b2a7b652ea7511692bef3548b487
SHA512 4c2ce036f0af8198b52eb62102456033e2d67e588b600b60bc7a6a13a07f50c57d0109c315c568aeaef790e314ed456a5b5f4e0bf5f4e5209aa41128bc097169

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

MD5 40f186fd55b11cd161e3ba0ed9dc3462
SHA1 109b9738a94314e92980da5c6a921022c00e7ce2
SHA256 283b951633d1f5673f979f98bc21c80b9a7d765539b4604b51e55b9531fb27a0
SHA512 1a4336644719eeb9ddaacf3ae6c254e00b90aad3db6e6156e58da000bb34e80922c7e0f9b2ee6430c6f04aeb9d9ed8f463d29a9f121601356ce03a899dcb5e05

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

MD5 40f186fd55b11cd161e3ba0ed9dc3462
SHA1 109b9738a94314e92980da5c6a921022c00e7ce2
SHA256 283b951633d1f5673f979f98bc21c80b9a7d765539b4604b51e55b9531fb27a0
SHA512 1a4336644719eeb9ddaacf3ae6c254e00b90aad3db6e6156e58da000bb34e80922c7e0f9b2ee6430c6f04aeb9d9ed8f463d29a9f121601356ce03a899dcb5e05

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

MD5 40f186fd55b11cd161e3ba0ed9dc3462
SHA1 109b9738a94314e92980da5c6a921022c00e7ce2
SHA256 283b951633d1f5673f979f98bc21c80b9a7d765539b4604b51e55b9531fb27a0
SHA512 1a4336644719eeb9ddaacf3ae6c254e00b90aad3db6e6156e58da000bb34e80922c7e0f9b2ee6430c6f04aeb9d9ed8f463d29a9f121601356ce03a899dcb5e05

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

MD5 40f186fd55b11cd161e3ba0ed9dc3462
SHA1 109b9738a94314e92980da5c6a921022c00e7ce2
SHA256 283b951633d1f5673f979f98bc21c80b9a7d765539b4604b51e55b9531fb27a0
SHA512 1a4336644719eeb9ddaacf3ae6c254e00b90aad3db6e6156e58da000bb34e80922c7e0f9b2ee6430c6f04aeb9d9ed8f463d29a9f121601356ce03a899dcb5e05

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

MD5 1edaafc14da2f840a735c984e746076f
SHA1 63baeed720a26a74927622dc400a990adfd551e0
SHA256 9c74ab18178948a9a0bef4ea424e2dd79d00b2a7b652ea7511692bef3548b487
SHA512 4c2ce036f0af8198b52eb62102456033e2d67e588b600b60bc7a6a13a07f50c57d0109c315c568aeaef790e314ed456a5b5f4e0bf5f4e5209aa41128bc097169

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

MD5 1edaafc14da2f840a735c984e746076f
SHA1 63baeed720a26a74927622dc400a990adfd551e0
SHA256 9c74ab18178948a9a0bef4ea424e2dd79d00b2a7b652ea7511692bef3548b487
SHA512 4c2ce036f0af8198b52eb62102456033e2d67e588b600b60bc7a6a13a07f50c57d0109c315c568aeaef790e314ed456a5b5f4e0bf5f4e5209aa41128bc097169

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

MD5 1edaafc14da2f840a735c984e746076f
SHA1 63baeed720a26a74927622dc400a990adfd551e0
SHA256 9c74ab18178948a9a0bef4ea424e2dd79d00b2a7b652ea7511692bef3548b487
SHA512 4c2ce036f0af8198b52eb62102456033e2d67e588b600b60bc7a6a13a07f50c57d0109c315c568aeaef790e314ed456a5b5f4e0bf5f4e5209aa41128bc097169

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

MD5 1edaafc14da2f840a735c984e746076f
SHA1 63baeed720a26a74927622dc400a990adfd551e0
SHA256 9c74ab18178948a9a0bef4ea424e2dd79d00b2a7b652ea7511692bef3548b487
SHA512 4c2ce036f0af8198b52eb62102456033e2d67e588b600b60bc7a6a13a07f50c57d0109c315c568aeaef790e314ed456a5b5f4e0bf5f4e5209aa41128bc097169

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

MD5 1edaafc14da2f840a735c984e746076f
SHA1 63baeed720a26a74927622dc400a990adfd551e0
SHA256 9c74ab18178948a9a0bef4ea424e2dd79d00b2a7b652ea7511692bef3548b487
SHA512 4c2ce036f0af8198b52eb62102456033e2d67e588b600b60bc7a6a13a07f50c57d0109c315c568aeaef790e314ed456a5b5f4e0bf5f4e5209aa41128bc097169

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

MD5 6ff6b4648b99241aa958b0d4dfa2158e
SHA1 b67c50922d4c5b80e5666922da193554e1182b3b
SHA256 ba05ff38fb1355cdbf2fee26129fa54ecbe3ac88ff2cc58896c42ffe5c46087b
SHA512 4b6a4bec0f1f6975bdf367fe9c149a4f21e4df004203aa4d05957e73a08ed4688d380f812b083ea4c8a9f067acadcc2b43b76029e6bc5c90bfcfb15a86ebbe82

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

MD5 5b43b837f753460621768059c25552e3
SHA1 3190b01b2200e6b642e52af3d3ea838cc63f5b90
SHA256 f8c50fc25db5f656f594f1555e1a4c1b750c836ec86574b4a28677828af09369
SHA512 d804a57140522c1a66a58e21096f1c754eb7c2342bf239c935e477edea2e7d1d794d9f94e2ed8be198e26749e41db16a648589090f2491fa84c21140933eacbd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

MD5 6dd5507f9eab9f6eb2a290117a673bb6
SHA1 cffdd5209cf4e5ce0104105a1da533b8e5a0ddb2
SHA256 64ba51e8ca7156415d29cf7ca4aaa19dfb0d5e1ba5ad0ed624f445cdd19101e7
SHA512 e996681dd51b5bf46b8f329dc507074f5e7584f1957bd312a68eb6fa6b4c5bafbb2bbdddade93af0b416d74cd71da45725857c926902f5ee82d7d66f8d2f4041

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

MD5 40f186fd55b11cd161e3ba0ed9dc3462
SHA1 109b9738a94314e92980da5c6a921022c00e7ce2
SHA256 283b951633d1f5673f979f98bc21c80b9a7d765539b4604b51e55b9531fb27a0
SHA512 1a4336644719eeb9ddaacf3ae6c254e00b90aad3db6e6156e58da000bb34e80922c7e0f9b2ee6430c6f04aeb9d9ed8f463d29a9f121601356ce03a899dcb5e05

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

MD5 6dd5507f9eab9f6eb2a290117a673bb6
SHA1 cffdd5209cf4e5ce0104105a1da533b8e5a0ddb2
SHA256 64ba51e8ca7156415d29cf7ca4aaa19dfb0d5e1ba5ad0ed624f445cdd19101e7
SHA512 e996681dd51b5bf46b8f329dc507074f5e7584f1957bd312a68eb6fa6b4c5bafbb2bbdddade93af0b416d74cd71da45725857c926902f5ee82d7d66f8d2f4041

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

MD5 40f186fd55b11cd161e3ba0ed9dc3462
SHA1 109b9738a94314e92980da5c6a921022c00e7ce2
SHA256 283b951633d1f5673f979f98bc21c80b9a7d765539b4604b51e55b9531fb27a0
SHA512 1a4336644719eeb9ddaacf3ae6c254e00b90aad3db6e6156e58da000bb34e80922c7e0f9b2ee6430c6f04aeb9d9ed8f463d29a9f121601356ce03a899dcb5e05

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

MD5 6dd5507f9eab9f6eb2a290117a673bb6
SHA1 cffdd5209cf4e5ce0104105a1da533b8e5a0ddb2
SHA256 64ba51e8ca7156415d29cf7ca4aaa19dfb0d5e1ba5ad0ed624f445cdd19101e7
SHA512 e996681dd51b5bf46b8f329dc507074f5e7584f1957bd312a68eb6fa6b4c5bafbb2bbdddade93af0b416d74cd71da45725857c926902f5ee82d7d66f8d2f4041

Analysis: behavioral2

Detonation Overview

Submitted

2022-03-20 14:01

Reported

2022-03-20 14:11

Platform

win10-20220310-en

Max time kernel

310s

Max time network

423s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Patch.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Patch.exe N/A

Checks installed software on the system

discovery

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\VEGAS\VEGAS Pro 17.0\protein\Protein_x64.4.1.dll C:\Users\Admin\AppData\Local\Temp\Patch.exe N/A
File opened for modification C:\Program Files\VEGAS\VEGAS Pro 17.0\vegas170.exe C:\Users\Admin\AppData\Local\Temp\Patch.exe N/A
File opened for modification C:\Program Files (x86)\Internet Download Manager\Sony Vegas Pro 17.0.0 Build 421 Patch Uninstaller.exe C:\Users\Admin\AppData\Local\Temp\Patch.exe N/A
File created C:\Program Files (x86)\Internet Download Manager\Sony Vegas Pro 17.0.0 Build 421 Patch Uninstalle.ini C:\Users\Admin\AppData\Local\Temp\Patch.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\rescache\_merged\3720402701\2219095117.pri C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
File opened for modification C:\Windows\Debug\ESE.TXT C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
File created C:\Windows\rescache\_merged\3720402701\2219095117.pri C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
File created C:\Windows\rescache\_merged\3720402701\2219095117.pri C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
File created C:\Windows\rescache\_merged\3720402701\2219095117.pri C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
File created C:\Windows\rescache\_merged\3720402701\2219095117.pri C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\system32\browser_broker.exe N/A
Key created \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\FontSize = "3" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Key created \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\DetectPhoneNumberCompleted = "1" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CacheLimit = "256000" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url4 = "https://login.live.com/" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PageSetup C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CacheLimit = "1" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\OneTimeCleanup = "1" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\AllComplete = "1" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\LastClosedHeight = "600" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IntelliForms C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main\OperationalData = "1" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{A5273FD9-E94E-42E9-931D-82E608C23884} = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Key created \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionI C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Key created \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Key created \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\AllComplete = "1" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\ClearBrowsingHistoryOnStart = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\SmartScreenCompletedVersio = "1" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming\ChangeUnitGenerationNeeded = "1" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Key created \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\InternetRegistry C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\"" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Key created \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar\WebBrowser C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites\Order = 0c0000000a000000000000000c0000000100000000000000 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\LastClosedWidth = "800" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\SharedCookie_MRACMigrationDone = "1" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\ManagerHistoryComplete = "1" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Key created \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Key created \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\TypedUrlsComplete = "1" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Patch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Patch.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Patch.exe

"C:\Users\Admin\AppData\Local\Temp\Patch.exe"

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca

C:\Windows\system32\browser_broker.exe

C:\Windows\system32\browser_broker.exe -Embedding

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

Network

Country Destination Domain Proto
US 8.8.8.8:53 crackingpatching.com udp
US 188.114.97.0:443 crackingpatching.com tcp
US 188.114.97.0:443 crackingpatching.com tcp
US 188.114.97.0:443 crackingpatching.com tcp
US 188.114.97.0:443 crackingpatching.com tcp

Files

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\Windows\3720402701\2219095117.pri

MD5 e2b88765ee31470114e866d939a8f2c6
SHA1 e0a53b8511186ff308a0507b6304fb16cabd4e1f
SHA256 523e419d2fa2e780239812d36caa37e92f8c3e6a5cd9f18f0d807c593effa45e
SHA512 462e8e6b4e63fc6781b6a9935b332a1dc77bfb88e1de49134f86fd46bd1598d2e842902dd9415a328e325bd7cdee766bd9473f2695acdfa769ffe7ba9ae1953d

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

MD5 f7dcb24540769805e5bb30d193944dce
SHA1 e26c583c562293356794937d9e2e6155d15449ee
SHA256 6b88c6ac55bbd6fea0ebe5a760d1ad2cfce251c59d0151a1400701cb927e36ea
SHA512 cb5ad678b0ef642bf492f32079fe77e8be20c02de267f04b545df346b25f3e4eb98bb568c4c2c483bb88f7d1826863cb515b570d620766e52476c8ee2931ea94

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

MD5 5e1b6a301221a77f496a07c40c2afe77
SHA1 1651bbc4af6096daa0728bdd59024f5df2b6404b
SHA256 9704813fa64108eefdb867a1c0d29172cbbde712627e46c50585a79248446436
SHA512 99a0c8fffe35d865c153ba6a81f434f95657a39ed321a13760a584460a9cc8baf5ef11852166168973fd5e9edf15198b007976d7cf5276fef4b5168e75c18dd7