Analysis Overview
SHA256
8d7ad4081ab12759da00302d3cdce17cf0929b68465525e5f9ac9dbd1a36a167
Threat Level: Known bad
The file 8d7ad4081ab12759da00302d3cdce17cf0929b68465525e5f9ac9dbd1a36a167 was found to be: Known bad.
Malicious Activity Summary
Detect ZGRat V1
ZGRat
SmokeLoader
RedLine payload
RedLine
Detect Mystic stealer payload
Glupteba
Glupteba payload
Mystic
Stops running service(s)
Downloads MZ/PE file
Executes dropped EXE
Checks computer location settings
Adds Run key to start application
AutoIT Executable
Drops file in Windows directory
Launches sc.exe
Unsigned PE
Program crash
Suspicious use of WriteProcessMemory
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of FindShellTrayWindow
Modifies registry class
Modifies Internet Explorer settings
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2023-11-11 19:04
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2023-11-11 19:04
Reported
2023-11-11 19:06
Platform
win10-20231023-en
Max time kernel
150s
Max time network
155s
Command Line
Signatures
Detect Mystic stealer payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Detect ZGRat V1
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Glupteba
Glupteba payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Mystic
RedLine
RedLine payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
SmokeLoader
ZGRat
Downloads MZ/PE file
Stops running service(s)
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1PF21oh0.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nL0Fz87.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Xg9Dk17.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bQ5MF76.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1PF21oh0.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\8d7ad4081ab12759da00302d3cdce17cf0929b68465525e5f9ac9dbd1a36a167.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nL0Fz87.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Xg9Dk17.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bQ5MF76.exe | N/A |
AutoIT Executable
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\rescache\_merged\3720402701\2219095117.pri | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| File opened for modification | C:\Windows\Debug\ESE.TXT | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| File created | C:\Windows\rescache\_merged\3720402701\2219095117.pri | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
| File created | C:\Windows\rescache\_merged\3720402701\2219095117.pri | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
Launches sc.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\CD7C.exe |
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000\Software\Microsoft\Internet Explorer\Main | C:\Windows\system32\browser_broker.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B72164C = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\SignaturePolicy = 06000000 | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\ACGPolicyState = "8" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\DynamicCodePolicy = 05000000 | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = c33177e1d114da01 | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. = "1" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "1" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "1" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3 | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 5f7cc3e1d114da01 | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000 | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 6b3539e1d114da01 | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1PF21oh0.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1PF21oh0.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1PF21oh0.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1PF21oh0.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1PF21oh0.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1PF21oh0.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1PF21oh0.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1PF21oh0.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1PF21oh0.exe | N/A |
Suspicious use of SendNotifyMessage
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1PF21oh0.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1PF21oh0.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1PF21oh0.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1PF21oh0.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1PF21oh0.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1PF21oh0.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1PF21oh0.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1PF21oh0.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1PF21oh0.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| N/A | N/A | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
| N/A | N/A | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
| N/A | N/A | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\8d7ad4081ab12759da00302d3cdce17cf0929b68465525e5f9ac9dbd1a36a167.exe
"C:\Users\Admin\AppData\Local\Temp\8d7ad4081ab12759da00302d3cdce17cf0929b68465525e5f9ac9dbd1a36a167.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nL0Fz87.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nL0Fz87.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Xg9Dk17.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Xg9Dk17.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bQ5MF76.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bQ5MF76.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1PF21oh0.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1PF21oh0.exe
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2zn4693.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2zn4693.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\7uj73DE.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\7uj73DE.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4944 -s 568
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\8LZ502ln.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\8LZ502ln.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\9uV1te5.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\9uV1te5.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
C:\Users\Admin\AppData\Local\Temp\CD7C.exe
C:\Users\Admin\AppData\Local\Temp\CD7C.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5876 -s 760
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
C:\Users\Admin\AppData\Local\Temp\2012.exe
C:\Users\Admin\AppData\Local\Temp\2012.exe
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe
"C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe"
C:\Users\Admin\AppData\Local\Temp\2785.exe
C:\Users\Admin\AppData\Local\Temp\2785.exe
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
C:\Users\Admin\AppData\Local\Temp\Broom.exe
C:\Users\Admin\AppData\Local\Temp\Broom.exe
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
C:\Users\Admin\AppData\Local\Temp\latestX.exe
"C:\Users\Admin\AppData\Local\Temp\latestX.exe"
C:\Users\Admin\AppData\Local\Temp\2785.exe
C:\Users\Admin\AppData\Local\Temp\2785.exe
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
C:\Users\Admin\AppData\Local\Temp\4.exe
C:\Users\Admin\AppData\Local\Temp\4.exe
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
C:\Windows\System32\sc.exe
sc stop UsoSvc
C:\Windows\System32\sc.exe
sc stop WaaSMedicSvc
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | accounts.google.com | udp |
| NL | 142.250.179.141:443 | accounts.google.com | tcp |
| NL | 142.250.179.141:443 | accounts.google.com | tcp |
| US | 8.8.8.8:53 | 141.179.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 48.101.122.92.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.facebook.com | udp |
| NL | 157.240.247.35:443 | www.facebook.com | tcp |
| NL | 157.240.247.35:443 | www.facebook.com | tcp |
| US | 8.8.8.8:53 | 35.36.251.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 35.247.240.157.in-addr.arpa | udp |
| NL | 142.250.179.141:443 | accounts.google.com | tcp |
| US | 8.8.8.8:53 | 195.179.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | store.steampowered.com | udp |
| NL | 104.85.0.101:443 | store.steampowered.com | tcp |
| NL | 104.85.0.101:443 | store.steampowered.com | tcp |
| US | 8.8.8.8:53 | static.xx.fbcdn.net | udp |
| US | 157.240.5.10:443 | static.xx.fbcdn.net | tcp |
| US | 157.240.5.10:443 | static.xx.fbcdn.net | tcp |
| US | 157.240.5.10:443 | static.xx.fbcdn.net | tcp |
| US | 157.240.5.10:443 | static.xx.fbcdn.net | tcp |
| US | 157.240.5.10:443 | static.xx.fbcdn.net | tcp |
| US | 157.240.5.10:443 | static.xx.fbcdn.net | tcp |
| US | 8.8.8.8:53 | facebook.com | udp |
| US | 157.240.5.35:443 | facebook.com | tcp |
| US | 157.240.5.35:443 | facebook.com | tcp |
| US | 8.8.8.8:53 | fbcdn.net | udp |
| US | 8.8.8.8:53 | 35.5.240.157.in-addr.arpa | udp |
| US | 157.240.5.35:443 | fbcdn.net | tcp |
| US | 157.240.5.35:443 | fbcdn.net | tcp |
| US | 8.8.8.8:53 | 10.5.240.157.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 101.0.85.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | steamcommunity.com | udp |
| US | 8.8.8.8:53 | twitter.com | udp |
| US | 8.8.8.8:53 | 25.101.122.92.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.epicgames.com | udp |
| US | 8.8.8.8:53 | fbsbx.com | udp |
| US | 157.240.5.35:443 | fbsbx.com | tcp |
| US | 157.240.5.35:443 | fbsbx.com | tcp |
| US | 8.8.8.8:53 | www.paypal.com | udp |
| US | 8.8.8.8:53 | store.cloudflare.steamstatic.com | udp |
| US | 104.18.42.105:443 | store.cloudflare.steamstatic.com | tcp |
| US | 104.18.42.105:443 | store.cloudflare.steamstatic.com | tcp |
| US | 104.244.42.193:443 | twitter.com | tcp |
| US | 104.244.42.193:443 | twitter.com | tcp |
| US | 8.8.8.8:53 | 105.42.18.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 193.42.244.104.in-addr.arpa | udp |
| JP | 23.207.106.113:443 | steamcommunity.com | tcp |
| JP | 23.207.106.113:443 | steamcommunity.com | tcp |
| US | 8.8.8.8:53 | 113.106.207.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 73.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | abs.twimg.com | udp |
| US | 8.8.8.8:53 | watson.telemetry.microsoft.com | udp |
| US | 104.208.16.94:443 | watson.telemetry.microsoft.com | tcp |
| US | 152.199.21.141:443 | abs.twimg.com | tcp |
| US | 152.199.21.141:443 | abs.twimg.com | tcp |
| US | 8.8.8.8:53 | 141.21.199.152.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 94.16.208.104.in-addr.arpa | udp |
| US | 104.208.16.94:443 | watson.telemetry.microsoft.com | tcp |
| US | 8.8.8.8:53 | killredls.pw | udp |
| US | 104.21.53.57:80 | killredls.pw | tcp |
| US | 18.210.178.3:443 | www.epicgames.com | tcp |
| US | 18.210.178.3:443 | www.epicgames.com | tcp |
| US | 8.8.8.8:53 | community.cloudflare.steamstatic.com | udp |
| US | 104.18.42.105:443 | community.cloudflare.steamstatic.com | tcp |
| US | 104.18.42.105:443 | community.cloudflare.steamstatic.com | tcp |
| RU | 5.42.92.51:19057 | tcp | |
| US | 151.101.1.21:443 | www.paypal.com | tcp |
| US | 151.101.1.21:443 | www.paypal.com | tcp |
| US | 8.8.8.8:53 | 57.53.21.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 3.178.210.18.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 21.1.101.151.in-addr.arpa | udp |
| US | 104.21.53.57:80 | killredls.pw | tcp |
| US | 104.21.53.57:80 | killredls.pw | tcp |
| US | 104.21.53.57:80 | killredls.pw | tcp |
| US | 8.8.8.8:53 | ocsp.r2m02.amazontrust.com | udp |
| US | 104.244.42.193:443 | twitter.com | tcp |
| US | 104.244.42.193:443 | twitter.com | tcp |
| US | 18.238.246.206:80 | ocsp.r2m02.amazontrust.com | tcp |
| NL | 142.250.179.141:443 | accounts.google.com | tcp |
| US | 104.21.53.57:80 | killredls.pw | tcp |
| US | 104.21.53.57:80 | killredls.pw | tcp |
| US | 8.8.8.8:53 | 192.15.239.18.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 80.41.65.18.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.246.238.18.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.179.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.paypalobjects.com | udp |
| US | 151.101.2.133:443 | www.paypalobjects.com | tcp |
| US | 151.101.2.133:443 | www.paypalobjects.com | tcp |
| US | 104.21.53.57:80 | killredls.pw | tcp |
| US | 8.8.8.8:53 | static-assets-prod.unrealengine.com | udp |
| US | 18.239.36.22:443 | static-assets-prod.unrealengine.com | tcp |
| US | 18.239.36.22:443 | static-assets-prod.unrealengine.com | tcp |
| US | 104.21.53.57:80 | killredls.pw | tcp |
| US | 8.8.8.8:53 | tracking.epicgames.com | udp |
| US | 44.214.245.214:443 | tracking.epicgames.com | tcp |
| US | 44.214.245.214:443 | tracking.epicgames.com | tcp |
| US | 104.21.53.57:80 | killredls.pw | tcp |
| US | 104.21.53.57:80 | killredls.pw | tcp |
| US | 104.21.53.57:80 | killredls.pw | tcp |
| US | 8.8.8.8:53 | 133.2.101.151.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 22.36.239.18.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 214.245.214.44.in-addr.arpa | udp |
| US | 104.21.53.57:80 | killredls.pw | tcp |
| US | 104.21.53.57:80 | killredls.pw | tcp |
| US | 104.21.53.57:80 | killredls.pw | tcp |
| US | 104.21.53.57:80 | killredls.pw | tcp |
| US | 104.21.53.57:80 | killredls.pw | tcp |
| US | 104.21.53.57:80 | killredls.pw | tcp |
| US | 8.8.8.8:53 | i.ytimg.com | udp |
| NL | 172.217.168.214:443 | i.ytimg.com | tcp |
| NL | 172.217.168.214:443 | i.ytimg.com | tcp |
| US | 104.21.53.57:80 | killredls.pw | tcp |
| US | 8.8.8.8:53 | 214.168.217.172.in-addr.arpa | udp |
| US | 104.21.53.57:80 | killredls.pw | tcp |
| US | 104.21.53.57:80 | killredls.pw | tcp |
| US | 104.21.53.57:80 | killredls.pw | tcp |
| US | 104.21.53.57:80 | killredls.pw | tcp |
| US | 104.21.53.57:80 | killredls.pw | tcp |
| US | 104.21.53.57:80 | killredls.pw | tcp |
| US | 157.240.5.10:443 | static.xx.fbcdn.net | tcp |
| US | 157.240.5.10:443 | static.xx.fbcdn.net | tcp |
| US | 104.21.53.57:80 | killredls.pw | tcp |
| US | 104.21.53.57:80 | killredls.pw | tcp |
| US | 8.8.8.8:53 | t.paypal.com | udp |
| US | 151.101.1.35:443 | t.paypal.com | tcp |
| US | 151.101.1.35:443 | t.paypal.com | tcp |
| US | 104.21.53.57:80 | killredls.pw | tcp |
| US | 8.8.8.8:53 | 106.208.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 35.1.101.151.in-addr.arpa | udp |
| US | 104.21.53.57:80 | killredls.pw | tcp |
| US | 151.101.2.133:443 | www.paypalobjects.com | tcp |
| US | 151.101.2.133:443 | www.paypalobjects.com | tcp |
| US | 104.21.53.57:80 | killredls.pw | tcp |
| US | 104.21.53.57:80 | killredls.pw | tcp |
| US | 8.8.8.8:53 | c.paypal.com | udp |
| US | 151.101.1.21:443 | c.paypal.com | tcp |
| US | 151.101.1.21:443 | c.paypal.com | tcp |
| US | 18.239.36.22:443 | static-assets-prod.unrealengine.com | tcp |
| US | 18.239.36.22:443 | static-assets-prod.unrealengine.com | tcp |
| US | 192.55.233.1:443 | tcp | |
| US | 192.55.233.1:443 | tcp | |
| US | 8.8.8.8:53 | 131.179.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.recaptcha.net | udp |
| NL | 172.217.168.227:443 | www.recaptcha.net | tcp |
| NL | 172.217.168.227:443 | www.recaptcha.net | tcp |
| US | 8.8.8.8:53 | 227.168.217.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 49.101.122.92.in-addr.arpa | udp |
| US | 104.21.53.57:80 | killredls.pw | tcp |
| US | 8.8.8.8:53 | watson.telemetry.microsoft.com | udp |
| US | 13.89.179.12:443 | watson.telemetry.microsoft.com | tcp |
| US | 104.21.53.57:80 | killredls.pw | tcp |
| US | 104.21.53.57:80 | killredls.pw | tcp |
| US | 104.21.53.57:80 | killredls.pw | tcp |
| US | 8.8.8.8:53 | 12.179.89.13.in-addr.arpa | udp |
| US | 104.21.53.57:80 | killredls.pw | tcp |
| US | 13.89.179.12:443 | watson.telemetry.microsoft.com | tcp |
| US | 104.21.53.57:80 | killredls.pw | tcp |
| US | 104.21.53.57:80 | killredls.pw | tcp |
| US | 8.8.8.8:53 | b.stats.paypal.com | udp |
| US | 64.4.245.84:443 | b.stats.paypal.com | tcp |
| US | 64.4.245.84:443 | b.stats.paypal.com | tcp |
| US | 104.21.53.57:80 | killredls.pw | tcp |
| US | 8.8.8.8:53 | 84.245.4.64.in-addr.arpa | udp |
| US | 104.21.53.57:80 | killredls.pw | tcp |
| US | 104.21.53.57:80 | killredls.pw | tcp |
| US | 192.55.233.1:443 | tcp | |
| US | 192.55.233.1:443 | tcp | |
| US | 104.21.53.57:80 | killredls.pw | tcp |
| US | 8.8.8.8:53 | dub.stats.paypal.com | udp |
| US | 64.4.245.84:443 | dub.stats.paypal.com | tcp |
| US | 64.4.245.84:443 | dub.stats.paypal.com | tcp |
| US | 8.8.8.8:53 | c6.paypal.com | udp |
| US | 8.8.8.8:53 | talon-website-prod.ecosec.on.epicgames.com | udp |
| US | 192.229.221.25:443 | c6.paypal.com | tcp |
| US | 192.229.221.25:443 | c6.paypal.com | tcp |
| US | 172.64.146.120:443 | talon-website-prod.ecosec.on.epicgames.com | tcp |
| US | 172.64.146.120:443 | talon-website-prod.ecosec.on.epicgames.com | tcp |
| US | 8.8.8.8:53 | steamcommunity.com | udp |
| US | 8.8.8.8:53 | 25.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 120.146.64.172.in-addr.arpa | udp |
| JP | 23.207.106.113:443 | steamcommunity.com | tcp |
| JP | 23.207.106.113:443 | steamcommunity.com | tcp |
| US | 8.8.8.8:53 | store.steampowered.com | udp |
| NL | 104.85.0.101:443 | store.steampowered.com | tcp |
| NL | 104.85.0.101:443 | store.steampowered.com | tcp |
| RU | 5.42.92.51:19057 | tcp | |
| US | 8.8.8.8:53 | 161.19.199.152.in-addr.arpa | udp |
| US | 8.8.8.8:53 | watson.telemetry.microsoft.com | udp |
| US | 52.168.117.173:443 | watson.telemetry.microsoft.com | tcp |
| US | 52.168.117.173:443 | watson.telemetry.microsoft.com | tcp |
| US | 8.8.8.8:53 | 173.117.168.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | talon-service-prod.ecosec.on.epicgames.com | udp |
| US | 172.64.146.120:443 | talon-service-prod.ecosec.on.epicgames.com | tcp |
| US | 172.64.146.120:443 | talon-service-prod.ecosec.on.epicgames.com | tcp |
| RU | 5.42.92.190:80 | 5.42.92.190 | tcp |
| NL | 194.169.175.118:80 | 194.169.175.118 | tcp |
| US | 8.8.8.8:53 | 190.92.42.5.in-addr.arpa | udp |
| RU | 5.42.65.80:80 | 5.42.65.80 | tcp |
| US | 8.8.8.8:53 | 118.175.169.194.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 80.65.42.5.in-addr.arpa | udp |
| US | 8.8.8.8:53 | api.steampowered.com | udp |
| JP | 23.207.106.113:443 | api.steampowered.com | tcp |
| JP | 23.207.106.113:443 | api.steampowered.com | tcp |
| JP | 23.207.106.113:443 | api.steampowered.com | tcp |
| JP | 23.207.106.113:443 | api.steampowered.com | tcp |
| NL | 142.250.179.141:443 | accounts.google.com | tcp |
| NL | 142.250.179.141:443 | accounts.google.com | tcp |
| US | 8.8.8.8:53 | js.hcaptcha.com | udp |
| US | 104.19.218.90:443 | js.hcaptcha.com | tcp |
| US | 104.19.218.90:443 | js.hcaptcha.com | tcp |
| US | 8.8.8.8:53 | 90.218.19.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 22.236.111.52.in-addr.arpa | udp |
| NL | 142.250.179.141:443 | accounts.google.com | tcp |
| NL | 142.250.179.141:443 | accounts.google.com | tcp |
| US | 8.8.8.8:53 | newassets.hcaptcha.com | udp |
| US | 104.19.218.90:443 | newassets.hcaptcha.com | tcp |
| US | 104.19.218.90:443 | newassets.hcaptcha.com | tcp |
| US | 8.8.8.8:53 | 1.208.79.178.in-addr.arpa | udp |
| US | 8.8.8.8:53 | watson.telemetry.microsoft.com | udp |
| US | 52.168.117.173:443 | watson.telemetry.microsoft.com | tcp |
| NL | 142.250.179.141:443 | accounts.google.com | tcp |
| NL | 142.250.179.141:443 | accounts.google.com | tcp |
| RU | 5.42.92.51:19057 | tcp | |
| NL | 172.217.168.214:443 | i.ytimg.com | tcp |
| NL | 172.217.168.214:443 | i.ytimg.com | tcp |
| US | 8.8.8.8:53 | watson.telemetry.microsoft.com | udp |
| US | 20.42.73.29:443 | watson.telemetry.microsoft.com | tcp |
| US | 8.8.8.8:53 | 29.73.42.20.in-addr.arpa | udp |
| US | 20.42.73.29:443 | watson.telemetry.microsoft.com | tcp |
| US | 8.8.8.8:53 | api.hcaptcha.com | udp |
| US | 104.19.219.90:443 | api.hcaptcha.com | tcp |
| US | 104.19.219.90:443 | api.hcaptcha.com | tcp |
| US | 8.8.8.8:53 | 90.219.19.104.in-addr.arpa | udp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 8.8.8.8:53 | 200.197.79.204.in-addr.arpa | udp |
| RU | 5.42.92.190:80 | 5.42.92.190 | tcp |
| IT | 185.196.9.161:80 | 185.196.9.161 | tcp |
| US | 8.8.8.8:53 | 161.9.196.185.in-addr.arpa | udp |
| RU | 5.42.64.16:443 | tcp | |
| US | 8.8.8.8:53 | 16.64.42.5.in-addr.arpa | udp |
| NL | 142.250.179.141:443 | accounts.google.com | tcp |
| NL | 142.250.179.141:443 | accounts.google.com | tcp |
| NL | 142.250.179.141:443 | accounts.google.com | tcp |
| NL | 142.250.179.141:443 | accounts.google.com | tcp |
| RU | 5.42.92.51:19057 | tcp | |
| US | 8.8.8.8:53 | watson.telemetry.microsoft.com | udp |
| US | 52.168.117.173:443 | watson.telemetry.microsoft.com | tcp |
| US | 52.168.117.173:443 | watson.telemetry.microsoft.com | tcp |
| NL | 142.250.179.141:443 | accounts.google.com | tcp |
| NL | 142.250.179.141:443 | accounts.google.com | tcp |
| NL | 172.217.168.214:443 | i.ytimg.com | tcp |
| NL | 172.217.168.214:443 | i.ytimg.com | tcp |
| NL | 142.250.179.141:443 | accounts.google.com | tcp |
| NL | 142.250.179.141:443 | accounts.google.com | tcp |
| US | 8.8.8.8:53 | watson.telemetry.microsoft.com | udp |
| US | 20.189.173.21:443 | watson.telemetry.microsoft.com | tcp |
| NL | 142.250.179.141:443 | accounts.google.com | tcp |
| NL | 142.250.179.141:443 | accounts.google.com | tcp |
| US | 8.8.8.8:53 | 21.173.189.20.in-addr.arpa | udp |
| US | 20.189.173.21:443 | watson.telemetry.microsoft.com | tcp |
| US | 8.8.8.8:53 | 4.173.189.20.in-addr.arpa | udp |
| NL | 142.250.179.141:443 | accounts.google.com | tcp |
| NL | 142.250.179.141:443 | accounts.google.com | tcp |
| RU | 5.42.92.51:19057 | tcp | |
| US | 8.8.8.8:53 | watson.telemetry.microsoft.com | udp |
| US | 20.189.173.21:443 | watson.telemetry.microsoft.com | tcp |
| NL | 172.217.168.214:443 | i.ytimg.com | tcp |
| NL | 172.217.168.214:443 | i.ytimg.com | tcp |
| NL | 157.240.247.35:443 | www.facebook.com | tcp |
| NL | 157.240.247.35:443 | www.facebook.com | tcp |
| US | 8.8.8.8:53 | 217.14.97.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | watson.telemetry.microsoft.com | udp |
| US | 20.42.65.92:443 | watson.telemetry.microsoft.com | tcp |
| US | 20.42.65.92:443 | watson.telemetry.microsoft.com | tcp |
| US | 8.8.8.8:53 | 92.65.42.20.in-addr.arpa | udp |
| RU | 5.42.92.190:80 | 5.42.92.190 | tcp |
| RU | 5.42.64.16:443 | tcp | |
| US | 8.8.8.8:53 | watson.telemetry.microsoft.com | udp |
| US | 13.89.179.12:443 | watson.telemetry.microsoft.com | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nL0Fz87.exe
| MD5 | 4d956945b58907c48923448f7a3f0d43 |
| SHA1 | 419089ea09fa7da0645cab4ee5b72c6a1eccbf39 |
| SHA256 | 39c057111d03bcc14a3ef49307d0efa3affd584f960a120b06fe3be16eb9f1c6 |
| SHA512 | c9af2639290966a62cc404028691d6df8d0b2e8a118571d9327236daab94f4440d3a8426cb5d5ac191721b4f6ab30dfe60dc5e7b8b85cb1aeecbaca0056c501d |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nL0Fz87.exe
| MD5 | 4d956945b58907c48923448f7a3f0d43 |
| SHA1 | 419089ea09fa7da0645cab4ee5b72c6a1eccbf39 |
| SHA256 | 39c057111d03bcc14a3ef49307d0efa3affd584f960a120b06fe3be16eb9f1c6 |
| SHA512 | c9af2639290966a62cc404028691d6df8d0b2e8a118571d9327236daab94f4440d3a8426cb5d5ac191721b4f6ab30dfe60dc5e7b8b85cb1aeecbaca0056c501d |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Xg9Dk17.exe
| MD5 | 0a2b681c25fa18704ab71b1f54cbcb9d |
| SHA1 | ec3e9cde1ac14da8a164dfb08508e5d28940d2dc |
| SHA256 | cf751b0fa311c5e886a38bb07a0c881d9af08574ed5214007190848ed7f90c00 |
| SHA512 | 264c8fc86c0355b5c1d44487abe62c15cc295cc25dd86bd4552e8a874e5ded3967b314a056a43358d116ac36581044143709e302fabf7e002e4b95de42bd7ad0 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Xg9Dk17.exe
| MD5 | 0a2b681c25fa18704ab71b1f54cbcb9d |
| SHA1 | ec3e9cde1ac14da8a164dfb08508e5d28940d2dc |
| SHA256 | cf751b0fa311c5e886a38bb07a0c881d9af08574ed5214007190848ed7f90c00 |
| SHA512 | 264c8fc86c0355b5c1d44487abe62c15cc295cc25dd86bd4552e8a874e5ded3967b314a056a43358d116ac36581044143709e302fabf7e002e4b95de42bd7ad0 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bQ5MF76.exe
| MD5 | 23982bb70cfc4c1368171bfb87470198 |
| SHA1 | f8f757765f0e9ebc0e5c4a8168bcd88cebf8b287 |
| SHA256 | 1840188d477e186ec1fa826aa3bd4052b1e7e804dfec986560c78b49e0a3ae7d |
| SHA512 | f7fdbe66677eea6cdcbd52a4280bf7ec0e1c1ce0a7f01fd3480af4a2f4ff458f2a4795a662ae2394b36022d733496cae24157161271e708b57dbd5c2f8230634 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bQ5MF76.exe
| MD5 | 23982bb70cfc4c1368171bfb87470198 |
| SHA1 | f8f757765f0e9ebc0e5c4a8168bcd88cebf8b287 |
| SHA256 | 1840188d477e186ec1fa826aa3bd4052b1e7e804dfec986560c78b49e0a3ae7d |
| SHA512 | f7fdbe66677eea6cdcbd52a4280bf7ec0e1c1ce0a7f01fd3480af4a2f4ff458f2a4795a662ae2394b36022d733496cae24157161271e708b57dbd5c2f8230634 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1PF21oh0.exe
| MD5 | 68a7e426179e5d11154207bb8bdea400 |
| SHA1 | d4ecbe3e96c5f18674d1b57ce74e40187bc5c901 |
| SHA256 | 4afa7110cdfab20651490c1e999e10882f7e7441abe42eec28202deb3bc6c9e9 |
| SHA512 | 0afc7aa7c662ff3e1cf830fe68230e83a93fd4ad3dbed8d7f54ab0d701d5a94b2351bcb412173bcbee9c07ee002c70ae7b7d37fd0098f0cc44171ae482cbbf3e |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1PF21oh0.exe
| MD5 | 68a7e426179e5d11154207bb8bdea400 |
| SHA1 | d4ecbe3e96c5f18674d1b57ce74e40187bc5c901 |
| SHA256 | 4afa7110cdfab20651490c1e999e10882f7e7441abe42eec28202deb3bc6c9e9 |
| SHA512 | 0afc7aa7c662ff3e1cf830fe68230e83a93fd4ad3dbed8d7f54ab0d701d5a94b2351bcb412173bcbee9c07ee002c70ae7b7d37fd0098f0cc44171ae482cbbf3e |
memory/4012-28-0x000001BA5A120000-0x000001BA5A130000-memory.dmp
memory/4012-44-0x000001BA5A600000-0x000001BA5A610000-memory.dmp
memory/4012-63-0x000001BA5A2E0000-0x000001BA5A2E2000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2zn4693.exe
| MD5 | 8d5ab27dfdaac2faa797b46f3dc98aa6 |
| SHA1 | 62685ae96436ae82571b371973910c7e74212239 |
| SHA256 | 833ce925b01c1b38998828715f2cf267e1c099b45a3b2a45b2cccea92e826d49 |
| SHA512 | 98f6c5e4bd23e7fd17e3cca0fea98b22daef49ca2a0d98f0bc03e9052e6f1c2f80a754699ba0fb8b626bf259e44559a7a5eb148e455107ca4d27ede715a3d6a7 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2zn4693.exe
| MD5 | 8d5ab27dfdaac2faa797b46f3dc98aa6 |
| SHA1 | 62685ae96436ae82571b371973910c7e74212239 |
| SHA256 | 833ce925b01c1b38998828715f2cf267e1c099b45a3b2a45b2cccea92e826d49 |
| SHA512 | 98f6c5e4bd23e7fd17e3cca0fea98b22daef49ca2a0d98f0bc03e9052e6f1c2f80a754699ba0fb8b626bf259e44559a7a5eb148e455107ca4d27ede715a3d6a7 |
memory/4944-86-0x0000000000400000-0x0000000000433000-memory.dmp
memory/4944-92-0x0000000000400000-0x0000000000433000-memory.dmp
memory/4944-94-0x0000000000400000-0x0000000000433000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\7uj73DE.exe
| MD5 | b938034561ab089d7047093d46deea8f |
| SHA1 | d778c32cc46be09b107fa47cf3505ba5b748853d |
| SHA256 | 260784b1afd8b819cb6ccb91f01090942375e527abdc060dd835992d88c04161 |
| SHA512 | 4909585c112fba3575e07428679fd7add07453e11169f33922faca2012d8e8fa6dfb763d991c68d3b4bbc6e78b6f37d2380c502daada325d73c7fff6c647769b |
memory/4944-98-0x0000000000400000-0x0000000000433000-memory.dmp
memory/5060-99-0x0000000000400000-0x000000000040B000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\7uj73DE.exe
| MD5 | b938034561ab089d7047093d46deea8f |
| SHA1 | d778c32cc46be09b107fa47cf3505ba5b748853d |
| SHA256 | 260784b1afd8b819cb6ccb91f01090942375e527abdc060dd835992d88c04161 |
| SHA512 | 4909585c112fba3575e07428679fd7add07453e11169f33922faca2012d8e8fa6dfb763d991c68d3b4bbc6e78b6f37d2380c502daada325d73c7fff6c647769b |
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\ZE14USG1.cookie
| MD5 | b1038269c62182ce42c9a91bd1d6c162 |
| SHA1 | 3360550a1c89c683a2b5ce0fb5a377b63b90eee2 |
| SHA256 | ed15971de739305c2c99e4a7cf6d7f78e87d1ed369a3edc7b6d6167392a5b913 |
| SHA512 | e42c70733118bd7b7cb782830423548c4ffd701d4eb4f61df57b7dd1dd248d3d2fc3788691d2076efba0736c836f1a33bd9ef9d377b56ecb32fa792cab1c2279 |
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_57CE1AECC398AD2C94DD1A683EAD09FC
| MD5 | df26803bd741cd8337ebbee4c99100c7 |
| SHA1 | 0c773c5482f47ed25356739cfae0e0d1f1655d73 |
| SHA256 | fd20571a9005f781b6452d345b8ea3e90c9cc88156795a3521cc16fae542355e |
| SHA512 | 6648aa7a8c307467e3174b50928aa19aa133f42a87b6332ef02aad85fe1b48b848145daba50ef220eb075699268547eb7a731874cdb197d89cd229f4cc962886 |
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_57CE1AECC398AD2C94DD1A683EAD09FC
| MD5 | a424524e2c25f8817094d4ae03d85437 |
| SHA1 | be31638d0e15de09123fb51cd4deda7c6eed149d |
| SHA256 | 5831c023d04b693ee97a5ee8a48e7fbf26390f92e60a482288a3bf91dd4e7bd7 |
| SHA512 | 9642e6a387dd08572512411d9f61340092aad46291eedbe883aee07dc1b8a514d2cd4e01ad3945d407f26fb2e68de0168236649a3dd4dd6b255db9539d6c5252 |
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
| MD5 | ac89a852c2aaa3d389b2d2dd312ad367 |
| SHA1 | 8f421dd6493c61dbda6b839e2debb7b50a20c930 |
| SHA256 | 0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45 |
| SHA512 | c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36 |
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
| MD5 | 225a7d84021e3246dc81fac0a89e8531 |
| SHA1 | 402f69a2293178105002dc73b02630e404962097 |
| SHA256 | d2a805cf288596bcf6f38f64566d5ec03ad18badd0855a15d50f64f5911f4d5f |
| SHA512 | 5a08fbefe0fbff014afde01f9d93f83d16fc52a50a6dc38ae2cf79fd40db80518b5617c7f23a74cdaafccb104a0bc1dfd8748d34321b07f070cc7047f3b371d8 |
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
| MD5 | 202c6d08618821679870b09397b327d4 |
| SHA1 | 95825d16b996f7ecd314ac66d68a7e166eb79b1e |
| SHA256 | 6cf0733f28bcebd3e25d33cc117773633a70241665ef8774fa42201161091bb9 |
| SHA512 | 2eec22005e9d9fd31374ee153b4adb3b47cdac1c08fae3a28b127fbcb2060b708392fa4e9326a80126c3633392dcd6f048d067787d6e2d792d08a3c745c01318 |
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
| MD5 | 177e0bf55138549fdae3e62f8c6d5ef3 |
| SHA1 | 19d78a29cc3266555f1f51a2fa3718c545d522ee |
| SHA256 | 7ea88f6e03fa7e7e072028ed16e6dcfbf6b73670af81320b641b646e9fb82247 |
| SHA512 | 2c108d6b3e221399b4ebd8a4d49d48de4622e04c6a8fc1938abeb5e8ead7ca73f7b88f4daa520f39dd86e1adff30186d42605b32ae0371d1638dfaaa6b0c32b1 |
memory/4208-125-0x000001D2F9560000-0x000001D2F9580000-memory.dmp
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\0X0FD3ZC.cookie
| MD5 | 25efe144966a2308bebf0d7d0f452b74 |
| SHA1 | d0376e5fc77304f190020e3198f0ab0f507d8dea |
| SHA256 | 98faa0824641806538a3dacbfe310515542a9f995f15588e3a9496aad3f37544 |
| SHA512 | 5aff2b5375dd2c7c5406e7da621a95e63064bac02bdc97f5264e63205304061c888221ae275dd479fcfabaa3cbe08d8549e608c880a1883c81a8abd778ca9f32 |
memory/2840-241-0x0000000000DE0000-0x0000000000DF6000-memory.dmp
memory/5060-244-0x0000000000400000-0x000000000040B000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\8LZ502ln.exe
| MD5 | 6c48bad9513b4947a240db2a32d3063a |
| SHA1 | a5b9b870ce2d3451572d88ff078f7527bd3a954a |
| SHA256 | 984ae46ad062442c543fcdb20b1a763001e7df08eb0ab24fc490cbf1ab4e54c8 |
| SHA512 | 7ae5c7bce222cfeb9e0fae2524fd634fa323282811e97a61c6d1e9680d025e49b968e72ca8ce2a2ceca650fa73bc05b7cf578277944305ed5fae2322ef7d496f |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\8LZ502ln.exe
| MD5 | 6c48bad9513b4947a240db2a32d3063a |
| SHA1 | a5b9b870ce2d3451572d88ff078f7527bd3a954a |
| SHA256 | 984ae46ad062442c543fcdb20b1a763001e7df08eb0ab24fc490cbf1ab4e54c8 |
| SHA512 | 7ae5c7bce222cfeb9e0fae2524fd634fa323282811e97a61c6d1e9680d025e49b968e72ca8ce2a2ceca650fa73bc05b7cf578277944305ed5fae2322ef7d496f |
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619
| MD5 | 80144ac74f3b6f6d6a75269bdc5d5a60 |
| SHA1 | 6707bb0c8a3e92d1fd4765e10781535433036196 |
| SHA256 | d746128fdb817742cb812c74fb8aa543191116feda6dfcfc59d74becf482a285 |
| SHA512 | c61d3847bdc0c4a4b8cd94b2d9a3a474b985b974776ca2ef4caf78e5fb82e4d4f65c477dec1cdf080f9d397f3d0dfe035adc267f9b4fe9b75c82e399f20bc6b3 |
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619
| MD5 | c930a5334bdfaba68d849bde5c16bb6f |
| SHA1 | cf56647bb55ecb93fb30be707d18227b31b5ae93 |
| SHA256 | fd057bd2c459b82e0ec7df55f8b1751a4c96d25ec44da7af2a71538be4e7a23c |
| SHA512 | 04817d4eb05b27123d1171e977b2277e9ae8b8233f5ec348912e9ebb4d5deee2cc13a1421f28077d555a037a095c75d0623f71964ffcb0d5400e464c8f760c5e |
memory/6120-261-0x0000000000400000-0x000000000043C000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\9uV1te5.exe
| MD5 | e5ee7dbfec6433859f0f737b2e2056e6 |
| SHA1 | 6bfda79b666acf86014f9af8a9bbd9de9b126b1c |
| SHA256 | e81216b5f783b3373dec0a91aa95afc427f7e77c1365e222064b1392abfda80b |
| SHA512 | c8326c1f3732cc3babc649d84684e52d5ce998eb28d618db98de84a64af945ef0e96d47be95305ad9fd606e8336cc26b277b14f295ffa05501b56ab53c8a038b |
memory/6120-268-0x0000000072360000-0x0000000072A4E000-memory.dmp
memory/6120-270-0x000000000C1E0000-0x000000000C6DE000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\9uV1te5.exe
| MD5 | e5ee7dbfec6433859f0f737b2e2056e6 |
| SHA1 | 6bfda79b666acf86014f9af8a9bbd9de9b126b1c |
| SHA256 | e81216b5f783b3373dec0a91aa95afc427f7e77c1365e222064b1392abfda80b |
| SHA512 | c8326c1f3732cc3babc649d84684e52d5ce998eb28d618db98de84a64af945ef0e96d47be95305ad9fd606e8336cc26b277b14f295ffa05501b56ab53c8a038b |
memory/6120-272-0x000000000BD80000-0x000000000BE12000-memory.dmp
memory/6120-274-0x000000000BD50000-0x000000000BD5A000-memory.dmp
memory/6120-275-0x000000000CCF0000-0x000000000D2F6000-memory.dmp
memory/6120-276-0x000000000C0B0000-0x000000000C1BA000-memory.dmp
memory/6120-277-0x000000000BFA0000-0x000000000BFB2000-memory.dmp
memory/6120-278-0x000000000C000000-0x000000000C03E000-memory.dmp
memory/5416-279-0x0000000000400000-0x0000000000488000-memory.dmp
memory/6120-280-0x000000000C040000-0x000000000C08B000-memory.dmp
memory/5416-283-0x0000000000400000-0x0000000000488000-memory.dmp
memory/5416-284-0x0000000000400000-0x0000000000488000-memory.dmp
memory/5416-288-0x0000000000400000-0x0000000000488000-memory.dmp
memory/912-290-0x000002C3CCA00000-0x000002C3CCA02000-memory.dmp
memory/912-293-0x000002C3CCA30000-0x000002C3CCA32000-memory.dmp
memory/912-296-0x000002C3CCA60000-0x000002C3CCA62000-memory.dmp
memory/912-298-0x000002C3CCAB0000-0x000002C3CCAB2000-memory.dmp
memory/912-300-0x000002C3CCAD0000-0x000002C3CCAD2000-memory.dmp
memory/912-303-0x000002C3CCDA0000-0x000002C3CCDA2000-memory.dmp
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
| MD5 | bbf0e29268ddfd99bde03e58039df96a |
| SHA1 | 3ba0542fed7734b1fcb484d73df8583d4c1cb11d |
| SHA256 | ccb67510824670f69ce2ed17ba72455f2be26d053ab13b2d04e8c4bbc2a456a4 |
| SHA512 | 4eac0c845359016b7045100c146d83b3c5e94ca7d319e4bcde9c19f880b89d33630aadbfbeb21c85295388826e046857aafba5b55fd22397537761586af0df35 |
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
| MD5 | cd84e50b4aea19f594c1413ebef80c7f |
| SHA1 | bb8c99dbca810476b997b66e9b97ca78a155ead1 |
| SHA256 | 93a1ac8552f079a85f6e8f48f083a100026ee84977ab87207e69ee8f1fdb2a48 |
| SHA512 | 5893dd644816ae52966f236ef0a2db8a2e9759ebe0883b39c5dac41a8b3eb956f73fe83085e7ed00f502b8c794b30bc9b6cb0da8bb9296934050174c381e0e45 |
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\49RCVIKK.cookie
| MD5 | 5582a52d6ae4dfec6aaac81712a368cd |
| SHA1 | c4a0d3bf798724c4dead6d1f3d7d6419736f6968 |
| SHA256 | e110baea1f29dc366fba7a0492e8647fa7fe09708a70daa4e1251287a592ffef |
| SHA512 | 310c3f81a3c1e743db7ca48e0b303f7f4ec0d9d17dbb2ade9a532cde2975bd696455d14d52120f2082603850d02572e74570492330908033c6ca3b8b73079f37 |
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\M0MQ25AP.cookie
| MD5 | 39b73d43ad79b8124a98359a306b33fc |
| SHA1 | 6331c3a5bec482b363d617f5fddbe14734b802fd |
| SHA256 | 195548d482857190aded06836d3ad04eda4ad2e1ebc477c96a95156327ac605a |
| SHA512 | 9f70ec3b3f691b57b1bd97b2d2b7cc0785515e09db3e7c73fc11ebbd685a5978fe927e9474549312c65087f77137581859528b4c5721ed55674ea4943ecfceb8 |
memory/4680-374-0x000001D3714D0000-0x000001D3714F0000-memory.dmp
memory/4012-390-0x000001BA61390000-0x000001BA61391000-memory.dmp
memory/4012-392-0x000001BA613A0000-0x000001BA613A1000-memory.dmp
memory/1612-407-0x00000236BB020000-0x00000236BB022000-memory.dmp
memory/1612-417-0x00000236BB0D0000-0x00000236BB0D2000-memory.dmp
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\0FXXIVGZ\favicon[1].ico
| MD5 | 630d203cdeba06df4c0e289c8c8094f6 |
| SHA1 | eee14e8a36b0512c12ba26c0516b4553618dea36 |
| SHA256 | bbce71345828a27c5572637dbe88a3dd1e065266066600c8a841985588bf2902 |
| SHA512 | 09f4e204960f4717848bf970ac4305f10201115e45dd5fe0196a6346628f0011e7bc17d73ec946b68731a5e179108fd39958cecf41125f44094f63fe5f2aeb2c |
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\DIW6N833.cookie
| MD5 | 04acaab526c99b0147511ae6779001f3 |
| SHA1 | 279dbcd15c04273ba63c427932e593673a7c5ab9 |
| SHA256 | bd95b1201565e9288a03a109e23c496cad4c5d096fb1fbefd0e482d2532a6067 |
| SHA512 | 4d2eaf6a9560ef4f6b59ec971a3a34c74cd0e995fab902fbe97b8945c394f83d01f20b3a567b5077845b16571f6ccd6ca822f241c997df78ab354571ffa0b77e |
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\JGNPM53S\www.epicgames[1].xml
| MD5 | c1ddea3ef6bbef3e7060a1a9ad89e4c5 |
| SHA1 | 35e3224fcbd3e1af306f2b6a2c6bbea9b0867966 |
| SHA256 | b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db |
| SHA512 | 6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed |
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\80TC1JSK\buttons[2].css
| MD5 | b91ff88510ff1d496714c07ea3f1ea20 |
| SHA1 | 9c4b0ad541328d67a8cde137df3875d824891e41 |
| SHA256 | 0be99fd30134de50d457729cebd0e08342777af747caf503108178cb4c375085 |
| SHA512 | e82438186bfc3e9ca690af8e099aafbfbc71c9310f9d1c8cb87ffa9e7f0f11f33982c63a2dac95c9b83fef1aaa59178b73212fc76e895d13a1ffbbe3c1adfa4c |
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\8V7CGE0O\shared_global[1].css
| MD5 | cfe7fa6a2ad194f507186543399b1e39 |
| SHA1 | 48668b5c4656127dbd62b8b16aa763029128a90c |
| SHA256 | 723131aba2cf0edd34a29d63af1d7b4ff515b9a3a3e164b2493026132dd37909 |
| SHA512 | 5c85bb6404d5be1871b0b2e2d2c9053716354acd69c7acca73d8ce8bf8f21645ae11f788f78ef624444016cb722ecbd6213e771bda36717725f2b60f53688c6b |
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\8V7CGE0O\shared_responsive[1].css
| MD5 | 2ab2918d06c27cd874de4857d3558626 |
| SHA1 | 363be3b96ec2d4430f6d578168c68286cb54b465 |
| SHA256 | 4afb3e37bfdd549cc16ef5321faf3f0a3bf6e84c79fc4408bc6f157280636453 |
| SHA512 | 3af59e0b16ef9d39c2f1c5ccdbd5c9ea35bd78571fde1b5bf01e51a675d5554e03225a2d7c04ed67e22569e9f43b16788105a0bf591ebba28ef917c961cc59e2 |
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\0FXXIVGZ\B8BxsscfVBr[1].ico
| MD5 | e508eca3eafcc1fc2d7f19bafb29e06b |
| SHA1 | a62fc3c2a027870d99aedc241e7d5babba9a891f |
| SHA256 | e6d1d77403cd9f14fd2377d07e84350cfe768e3353e402bf42ebdc8593a58c9a |
| SHA512 | 49e3f31fd73e52ba274db9c7d306cc188e09c3ae683827f420fbb17534d197a503460e7ec2f1af46065f8d0b33f37400659bfa2ae165e502f97a8150e184a38c |
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\8V7CGE0O\tooltip[1].js
| MD5 | 72938851e7c2ef7b63299eba0c6752cb |
| SHA1 | b75196bd3a6f9f4dfc1bbf5e43e96874bcd9ce4e |
| SHA256 | e2d4e0e1d3e162fdc815f16dfff9ae9b0a967949f0f3ae371f947d730a3f0661 |
| SHA512 | 2bb6c03a1335ef9514d0d172a4284d82a29d1783a72306bdcb8af3185d5cd2ff16303355aa4b05086d2fa0b5b7c7159cfa67de4a6175095ff0e68adec2a56ac1 |
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\SNEP41VF\shared_global[1].js
| MD5 | f94199f679db999550a5771140bfad4b |
| SHA1 | 10e3647f07ef0b90e64e1863dd8e45976ba160c0 |
| SHA256 | 26c013d87a0650ece1f28cdc42d7995ad1a57e5681e30c4fd1c3010d995b7548 |
| SHA512 | 66aef2dda0d8b76b68fd4a90c0c8332d98fe6d23590954a20317b0129a39feb9cd3bd44e0c57e6b309227d912c6c07b399302a5e680615e05269769b7e750036 |
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\SNEP41VF\shared_responsive_adapter[1].js
| MD5 | a52bc800ab6e9df5a05a5153eea29ffb |
| SHA1 | 8661643fcbc7498dd7317d100ec62d1c1c6886ff |
| SHA256 | 57cfaf9b92c98541f769090cd0229a30013cea7cfafc18519ca654bfae29e14e |
| SHA512 | 1bcacd0ec7c3d633d6296fff3325802d6352805f0d2cf1eea39237424229ecffad6cb2aee4248e28b1eca02ff0646b58240851a246bbcf0aa1083830d5d9081e |
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\EPTEM17M.cookie
| MD5 | e5b1eec05d710cd3f8f6487c5e885634 |
| SHA1 | df593e547c632aa91ac300c26716166fb641d238 |
| SHA256 | 5d5245b804081b2e92c0cce4eaa6bc9f5dee9952c4e5cd9f503b388fbf2864ac |
| SHA512 | ab9f9e4be0160cdd41f0fb4b906a11bf1f393d36a37366a5231d0d781f042e29185fc7da8699b877f8ec674c6954242386ab4941d0cd2bd3f21e1776f332295b |
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\JGNPM53S\www.epicgames[1].xml
| MD5 | 06222da91010404e6aca887a9b80e303 |
| SHA1 | 029b285f539611bc5a39179db65940b2f345f35b |
| SHA256 | 273e633e36f3ef33d1464acf350241e095baf7c269708520d6cd821ebffb4d46 |
| SHA512 | cdf0dc3f8888798c1bd9ade87609785d03cbc1f0442687a5ac4bc03a95c9837057ca357fc52d9c4681a0367be2d93ae57b194c04042a725f4e59cf373b4ab010 |
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\UYKQRG1Q\pp_favicon_x[1].ico
| MD5 | e1528b5176081f0ed963ec8397bc8fd3 |
| SHA1 | ff60afd001e924511e9b6f12c57b6bf26821fc1e |
| SHA256 | 1690c4e20869c3763b7fc111e2f94035b0a7ee830311dd680ac91421daad3667 |
| SHA512 | acf71864e2844907752901eeeaf5c5648d9f6acf3b73a2fb91e580bee67a04ffe83bc2c984a9464732123bc43a3594007691653271ba94f95f7e1179f4146212 |
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\ZFRXUBKI.cookie
| MD5 | 36824db7c5018a6d7dbeae39ba70b54b |
| SHA1 | 0d20c9723b21fefd0e14a6351729f8fc6f9a76fc |
| SHA256 | e1554ad9c464628c06bbe19e77b632e97ccbf81df436dee70f7e7ec0d0203264 |
| SHA512 | 0eb43ce9188dcde53547f2ebc5a657aa0069f89cf68d11ad97ba7540f57ac3435e75a2144b703732764785081017e201f773951cb60710fe269f3c6dc31d5e61 |
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\UFILYM62.cookie
| MD5 | 54f5f50b8e8567be164043fa7d013650 |
| SHA1 | db353f77b559ffcf65a3d70a965209c2cccb75f7 |
| SHA256 | 071913fa7a4737d5c7ef1a37b7958bebbc016c3ca9248cc7251688d4f6d84d0a |
| SHA512 | e51ab0787277a8e1bf7ec8dd8095fb0ac813252cab693d8e7bc95bf9af32a3923ef499abdbd127589ce0e6d43b565ebb025ac2a4c232861b9b08235be4880f4d |
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\NQP3FH5P\epic-favicon-96x96[1].png
| MD5 | c94a0e93b5daa0eec052b89000774086 |
| SHA1 | cb4acc8cfedd95353aa8defde0a82b100ab27f72 |
| SHA256 | 3f51f3fb508f0d0361b722345974969576daef2c7d3db8f97c4ca8e1ff1a1775 |
| SHA512 | f676705e63f89d76520637b788f3bac96d177d1be7f9762aeb8d5d1554afd7666cbd6ef22ce08f581eb59bd383dd1971896231264bc3eaabf21135c967930240 |
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\ImageStore\6s59bvu\imagestore.dat
| MD5 | ef77e793463f09d4016f5b0ab09ea23b |
| SHA1 | cd8e8fb970ddc2f0283dcb118cdcc174f07199fc |
| SHA256 | 910df8a7fe4c579942b3b813d16db2857e7ff09bdbab040909c53256cf887d19 |
| SHA512 | a7d950e6888d49b69619b268d04db0b60ce5b2d48e01c4b6f163f48e7a102bca24e035ad6ac6ae8dceb95bd0c86495795be8e0ccf4f538cda7e1a6c59972d058 |
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_57DB0353F73BFEAADC2A8A5ECA70ACE8
| MD5 | 42543f480eb00f895387212a369b1075 |
| SHA1 | aa04603bbd708a4727befd7b8f354f23d5953f4a |
| SHA256 | f0872218ff6e9878a0d0772d60c56638f7c5932a717598e239494f597561b95d |
| SHA512 | 197c197044c0446c0e7e21aeae8daad060ad24f2f879b6227e4b90449b73968a41cb7f724387c11345bf11758c5194dc6b6a889367873bc2c915f391c856744d |
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_57DB0353F73BFEAADC2A8A5ECA70ACE8
| MD5 | 263aaa5dd83f111bb0ac2d30aac30e50 |
| SHA1 | d99b60a5dd85beea1f5595b8f45791a1258af799 |
| SHA256 | 90db36acabb4102c565dae5b885ccd3a0dab9eb0a529cf2a4f0df744a46368cb |
| SHA512 | b4f7b9b0bc9432257d9bb7a8bc4afbf162531d485637ba04948574b2b9c3ccdb7435eaf6a1bfc1079e84abe755446292606aa5c36a93bc3b91b1a950ba6b8848 |
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\BK8J73GX.cookie
| MD5 | f2294170aef0c135931b57792dab8021 |
| SHA1 | e966570610484f486721c07feeb31573ad3afada |
| SHA256 | 787a48def8e23a976f39444548f546d296d1ab66e5f7ce2255c4e2c18907f589 |
| SHA512 | 06f37a7ce4f29f3654dd385a430e8e827324d8264a8eef6dfda61a2cf2947662ef10e2e12d97f9e384518db9a29e51d35e7d9604c8b11f0c998ecf97693eb20e |
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\KBKYY0U0.cookie
| MD5 | a0c055062d60ec7a77482c350b54f0c3 |
| SHA1 | 5d0f579119bef5d602167eb54553fc30c7fab6d7 |
| SHA256 | d58b8cf1a853194ab52599c5bd21aeda876cd8e73b9b38849fd39360d31fcaff |
| SHA512 | a553c4b138dfebff8ca31decc37a94c6b4460e6d06cab19ed1220a64c8858304db1174ced3607fada30442b785def3194c46c9119c745d6a9be86c87e802f59c |
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\HNUVRD4R.cookie
| MD5 | 57e2584e021ddb8403e2b5b10e60e4d1 |
| SHA1 | 161328bae1464cb5e618f25d8edafd354701a8b1 |
| SHA256 | cf57ea22797a3c443eb16cf7289e2c9bafb324e64e7879cb4e668e6ffde704c5 |
| SHA512 | 64344aeb88e12e5daf7b511721f92fb5c2c014f47683b043c927e48fac6e309fe5295f533456774708d68731d38f8f42b5f4fbbe63cd485236be032fbda80f22 |
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\JIAPNFAC.cookie
| MD5 | d51eef8fe69a77c0f1d1e3d3e3aed45e |
| SHA1 | 6bd082322f922817ab734333cff3d8d0dc05548c |
| SHA256 | a7b83676a90f5172ec775ddc5fdbb059f7f4fd21b94181bfddec8ca2f5c697d6 |
| SHA512 | 412f3934f9d1c8bbb348cc74ce0db2bb73f4eec3b928a708fd7d021c38c8906a6aabf93ce0bf6021fc7b86be8773fcd03b43e3c45bfcc28753f0a8389f6471ce |
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\DIOFV5AJ.cookie
| MD5 | 748eae6fc6eb874d827d9f495c0e0370 |
| SHA1 | 574ce2176d4298bc6f6f093962d6ecbfec1e05e3 |
| SHA256 | 0b125f7cb1fd5ed303a029d84783ce3efc0fe36a447b0f01ae6dc905cd129e8a |
| SHA512 | 2066b084134eadb751b062a8b0febd3867e8086fc787ceec73761fea4202e86b8510470299ef32d83f7ab5f8da8276fc42d50deea4621695c1c600c2771b6a9f |
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\A1KIXIV7.cookie
| MD5 | dfa0e333a66fe1348ab186ebe3be99ea |
| SHA1 | 621f0593d541ff40055c297c37dbd0c33b27cee2 |
| SHA256 | 6ba3ec073dacc5a7226577a319a3ad7f5bf4013efad3b8037661e0070659e09e |
| SHA512 | d4234e7f3c28e693a32be73ceb48de3d038f3b8d9b0b5a524878dddde1d3ba4e5afbe26205734e66f9283cbc558fc8472332f8bfcf595215d887954af436df9e |
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\0FXXIVGZ\favicon[2].ico
| MD5 | 231913fdebabcbe65f4b0052372bde56 |
| SHA1 | 553909d080e4f210b64dc73292f3a111d5a0781f |
| SHA256 | 9f890a9debcdfccc339149a7943be9aff9e4c9203c2fa37d5671a5b2c88503ad |
| SHA512 | 7b11b709968c5a52b9b60189fb534f5df56912417243820e9d1c00c97f4bd6d0835f2cdf574d0c36ecb32dbbf5fc397324df54f7fdf9e1b062b5dbda2c02e919 |
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\80TC1JSK\recaptcha__en[1].js
| MD5 | fbeedf13eeb71cbe02bc458db14b7539 |
| SHA1 | 38ce3a321b003e0c89f8b2e00972caa26485a6e0 |
| SHA256 | 09ed391c987b3b27df5080114e00377ff1a748793cb417a809b33f22d737fe55 |
| SHA512 | 124b9f53a53ef596a54c6c04ab3be2b25d33d1ce915978ec03da8f9f294db91d41ee9091b722e462722f51f9d9455ce480e1a0cb57c2f3248c7a3a9e3b9dac58 |
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\SNEP41VF\chunk~9229560c0[1].css
| MD5 | 19a9c503e4f9eabd0eafd6773ab082c0 |
| SHA1 | d9b0ca3905ab9a0f9ea976d32a00abb7935d9913 |
| SHA256 | 7ba0cc7d66172829eef8ff773c1e9c6e2fde3cfd82d9a89e1a71751957e47b0a |
| SHA512 | 0145582e8eb3adb98ad2dbc0b8e7a29c1d0525f0fd515fcf82eda7b4ce2f7f7f6aa0e81912aa98927e6d420ed110eb497c287a0ad483f8af067332920d4bde83 |
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\OOWN79G4.cookie
| MD5 | 89f86f1367dd717b42e27173d8d86e8c |
| SHA1 | 92b5600e6ba3b62871e37976f6eca02bfb8c3596 |
| SHA256 | c70c8eb2730ed20ca2ac98d3a3227c8649a3c763752c23c73c1996f21c3fc6ff |
| SHA512 | f1c6ec6cbbd73060f2c2289cd7f07f502d57417beeb35402db22ffb991e55f72f7714925fa21fdaf5dcbb654c705860632c5537b8ea963527c181dcc739fc066 |
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\45O5AJ8D.cookie
| MD5 | 71a5cdfc47e6b8e56ba06767354f45c1 |
| SHA1 | eb0c207597be8368c10f9dc69264ef46b13cf19e |
| SHA256 | 706fe3a485e019bec6a5a481833b50e191367d3dd55c12f7ba445831799953a0 |
| SHA512 | 0d07afd617991e9b1a568c3f920c7aa10eeed491b18c3a0f3940a6936b5abaf8268ee81e14d9386ae73c91bfc3b7e817c11ee802643191f4f0c64ca950083768 |
C:\Users\Admin\AppData\Local\MicrosoftEdge\SharedCacheContainers\MicrosoftEdge_iecompat\IECompatData.xml
| MD5 | d4fc49dc14f63895d997fa4940f24378 |
| SHA1 | 3efb1437a7c5e46034147cbbc8db017c69d02c31 |
| SHA256 | 853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1 |
| SHA512 | cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a |
C:\Users\Admin\AppData\Local\Temp\CD7C.exe
| MD5 | 557fef65be6a41dae25cc30e05cbbcf5 |
| SHA1 | 1f2d15725911e8fb97556bde6ed98a883be559df |
| SHA256 | c43ba1b96be77608af07fa060f47f99604610ea712bf71f19c2d32f70b35beb1 |
| SHA512 | e513106d493c6ca18ea5be85a8ab198f19d97edd8dd5b21fc4daafc7f27b647116efaf3366d686e158f79ad9011ca1013fac00620d366085cc04ada8ac8dc5a0 |
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\KEALQWRU.cookie
| MD5 | ede89da04f90521e46228d1eb66e38ad |
| SHA1 | 297cf73a2d2bd87bc119f04319be241d012ff16f |
| SHA256 | 08a57f136e32f8e7191b60008e39fd6a38e53cbf7c7a347a47100d5e2331a8b3 |
| SHA512 | 76e4e8bf996b3c20418105921f44d68577d03350fec02a0dc5198cbb4093ea7cb916e237d2e096e3f07cb2bc8572193a6c634c9583788bb937d0a7c21906b675 |
C:\Users\Admin\AppData\Local\Temp\CD7C.exe
| MD5 | 557fef65be6a41dae25cc30e05cbbcf5 |
| SHA1 | 1f2d15725911e8fb97556bde6ed98a883be559df |
| SHA256 | c43ba1b96be77608af07fa060f47f99604610ea712bf71f19c2d32f70b35beb1 |
| SHA512 | e513106d493c6ca18ea5be85a8ab198f19d97edd8dd5b21fc4daafc7f27b647116efaf3366d686e158f79ad9011ca1013fac00620d366085cc04ada8ac8dc5a0 |
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\2HEI2I2J.cookie
| MD5 | e4e5cad7d109f61e6f2700718e9ac0e6 |
| SHA1 | 0e3e5cc6068de1fc5caf70f84c1c29724426faa4 |
| SHA256 | e47b7b23ef0273376e2de036b46ff2169da5235314737887fdcf171392ff151f |
| SHA512 | 038418bbebadc3dc433f3384649072eaa4358175a8ddebb1a0aba2b22daf4aa21fbfac4747f621e2780c3da6a0f5ed55bb948a94ae86116db43fdd1a2a837c06 |
memory/5876-2493-0x0000000000400000-0x000000000046F000-memory.dmp
memory/5876-2505-0x0000000072360000-0x0000000072A4E000-memory.dmp
\Users\Admin\AppData\Local\Temp\CD7C.exe
| MD5 | 557fef65be6a41dae25cc30e05cbbcf5 |
| SHA1 | 1f2d15725911e8fb97556bde6ed98a883be559df |
| SHA256 | c43ba1b96be77608af07fa060f47f99604610ea712bf71f19c2d32f70b35beb1 |
| SHA512 | e513106d493c6ca18ea5be85a8ab198f19d97edd8dd5b21fc4daafc7f27b647116efaf3366d686e158f79ad9011ca1013fac00620d366085cc04ada8ac8dc5a0 |
\Users\Admin\AppData\Local\Temp\CD7C.exe
| MD5 | 557fef65be6a41dae25cc30e05cbbcf5 |
| SHA1 | 1f2d15725911e8fb97556bde6ed98a883be559df |
| SHA256 | c43ba1b96be77608af07fa060f47f99604610ea712bf71f19c2d32f70b35beb1 |
| SHA512 | e513106d493c6ca18ea5be85a8ab198f19d97edd8dd5b21fc4daafc7f27b647116efaf3366d686e158f79ad9011ca1013fac00620d366085cc04ada8ac8dc5a0 |
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\JWRTL39S.cookie
| MD5 | d33240f1172f7eaa6b6b4df6a080eece |
| SHA1 | 58ea7b62cb59915c389baf9f8b471d06d2791d25 |
| SHA256 | 9276e61cbbe31e5f67f65a5c51da1d8b2d55bc02a896f19b94b433576a26cb8d |
| SHA512 | 0aa1ae67902432ed7cdedb56877900f3cd66c28f1edc19bf1aa5d2a6854d98886e0d6fa82adc2b9cb955641842d11d510b9d343cfcef27240e273fe9bb7513e6 |
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\CS3SZODK\www.recaptcha[1].xml
| MD5 | 67ba028bcbef449b0a03c672ffb7e02e |
| SHA1 | 261dc5727d563224697a4f0c323704eb9e29d069 |
| SHA256 | 3f7eb471a3cb78a0e1504a92b6d395f75ee71684657f04843334876a0e06a775 |
| SHA512 | 4ba3df2b3ba03628b9795ec959b87ad7383afa0524c2f9514c0dacaa03a482ed31783441288efe86082c2e5a24d15a63719a35f38b8047147f459ebc04c6c54b |
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\Q3OXHYOM.cookie
| MD5 | 480ea675420e32c13c3005f367ff7efe |
| SHA1 | 5b58110e7384bb1032ddd34cc6ceef6a99644c00 |
| SHA256 | a64a0a1e8b810bdeb376aa34576e852345beb8e249681f5a97c80e09f8a7c5e9 |
| SHA512 | 53e7f175371ea1868db08c872de41ac83f6e26f4cf592bce62707ce7ca4123120965f2bbd11cc926cd73b17c15993c9a6ef5eb2a2f090b94d1222c871bda7bcf |
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\LPADNC5R.cookie
| MD5 | 1872e79d0846a8039cd7da8fab99eaf8 |
| SHA1 | 5923ca03e695b34dbe11cb5017286fbe57614ec6 |
| SHA256 | 3a9db37addee881e5929ef4ffed1edbf0b08f849ba0a0cbbf5a4e5d1b6474669 |
| SHA512 | 810a32f01ef66e96aa13b0ce368012710816928218fe7331312f6e5393d4ef448fec777cbd2a0990be7b1a9bbfac07c51f3f00412be244801a18f56a2332e9d4 |
memory/6120-2753-0x0000000072360000-0x0000000072A4E000-memory.dmp
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_11314361DFE3E655E02EC2E7F9346EC1
| MD5 | ba3d7074866d3e720f90789bc60b02ab |
| SHA1 | 50276b2e72a411ac8587a7113657f1b3e7a02bef |
| SHA256 | e353e197b88e44c0841a510d8239058a357d6d35a14f3ead7e7a5f189e9cb4fc |
| SHA512 | bd0c6816dc2d0de098604cc7873715ff856149f47583098e9d081b2d02a219047579f4249bc99b0ab403b4b61217497e0402600ea737c50366c6b434dbfbeebd |
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_11314361DFE3E655E02EC2E7F9346EC1
| MD5 | 1654a084e151f728e0b88fb30183a8b1 |
| SHA1 | a4f186116c92d3379b0458b1b2e122f8d402f2de |
| SHA256 | 9941c30b86702be5bbe17bad52d4a92e399ca3c72c4bbf86ce93d20a96b585ea |
| SHA512 | ff919a34135d886832f964c6c8586439dce68013922160dba6dbfe241f30978c448a4a6e2c5ffcbfa8c53b127bf452d142bb969c3783c0413bf05bfc1ad56f4e |
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\2AFZV8EX.cookie
| MD5 | bd10ce8cc1d04ca896981f474a1686be |
| SHA1 | d03b61534aac59b9c8dad3923efa3c82e8639f09 |
| SHA256 | afbac195c55c41ce4115ec07e2753dc75a5239a05f7b4a6c07716ee9767a1b33 |
| SHA512 | 6ac45efb0d264fcfd373a86888615e5b3a7d573357474f8ef37b142223ef79de2c1ca88a334259f36c3cf156e5698848542e36da78706aeb5905f5b7d139b730 |
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\80TC1JSK\web-animations-next-lite.min[1].js
| MD5 | cb9360b813c598bdde51e35d8e5081ea |
| SHA1 | d2949a20b3e1bc3e113bd31ccac99a81d5fa353d |
| SHA256 | e0cbfda7bfd7be1dcb66bbb507a74111fc4b2becbc742cd879751c3b4cbfa2f0 |
| SHA512 | a51e7374994b6c4adc116bc9dea60e174032f7759c0a4ff8eef0ce1a053054660d205c9bb05224ae67a64e2b232719ef82339a9cad44138b612006975578783c |
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\SNEP41VF\webcomponents-ce-sd[1].js
| MD5 | 58b49536b02d705342669f683877a1c7 |
| SHA1 | 1dab2e925ab42232c343c2cd193125b5f9c142fa |
| SHA256 | dea31a0a884a91f8f34710a646d832bc0edc9fc151ffd9811f89c47a3f4a6d7c |
| SHA512 | c7a70bdefd02b89732e12605ad6322d651ffa554e959dc2c731d817f7bf3e6722b2c5d479eb84bd61b6ee174669440a5fa6ac4083a173b6cf5b30d14388483d4 |
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\SNEP41VF\intersection-observer.min[1].js
| MD5 | 936a7c8159737df8dce532f9ea4d38b4 |
| SHA1 | 8834ea22eff1bdfd35d2ef3f76d0e552e75e83c5 |
| SHA256 | 3ea95af77e18116ed0e8b52bb2c0794d1259150671e02994ac2a8845bd1ad5b9 |
| SHA512 | 54471260a278d5e740782524392249427366c56b288c302c73d643a24c96d99a487507fbe1c47e050a52144713dfeb64cd37bc6359f443ce5f8feb1a2856a70a |
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\QRTA9FON\scheduler[1].js
| MD5 | 3403b0079dbb23f9aaad3b6a53b88c95 |
| SHA1 | dc8ca7a7c709359b272f4e999765ac4eddf633b3 |
| SHA256 | f48cc70897719cf69b692870f2a85e45ecf0601fd672afcd569495faa54f6e48 |
| SHA512 | 1b7f23639fd56c602a4027f1dd53185e83e3b1fa575dc29310c0590dd196dc59864407495b8cc9df23430a0f2709403d0aa6ec6d234cce09f89c485add45b40e |
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_26971925776788617818974D91697792
| MD5 | 245818537103eff3e5f1a84f75a8019f |
| SHA1 | 39cfc2d90b5e931c4175c327d0c9cbe245e2844f |
| SHA256 | f8957e9e46b77f054c797e590738c64eccad346821bd2f4b310a649c9f43b41a |
| SHA512 | 8d3b5525ee52051918e039d8c4775e3a38c7688f6dfff6e8dec1b19d743bfd79157ba77400c7166dfbaed359135a73c1c47de924790de6587619a8654bba6fe3 |
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_26971925776788617818974D91697792
| MD5 | 695308f4bf7ce8a97ff889228e55dcec |
| SHA1 | 5b529c658d9e39201039a8d83a974717ac1ba64f |
| SHA256 | 10af4f722c6d79a857f6d4c8aa5c6cc60bf4ec9c8ca97c7f401cb8484eefaba4 |
| SHA512 | 6f2b4bc44575303235303355e1189fbac7e7d90ecec74d3f2c5db8b57d6a871b50f2baefc8ca8d4db2ee3b23ff7c26a6c8927007d1d7e813bda6529f37698c88 |
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\80TC1JSK\www-i18n-constants[1].js
| MD5 | f3356b556175318cf67ab48f11f2421b |
| SHA1 | ace644324f1ce43e3968401ecf7f6c02ce78f8b7 |
| SHA256 | 263c24ac72cb26ab60b4b2911da2b45fef9b1fe69bbb7df59191bb4c1e9969cd |
| SHA512 | a2e5b90b1944a9d8096ae767d73db0ec5f12691cf1aebd870ad8e55902ceb81b27a3c099d924c17d3d51f7dbc4c3dd71d1b63eb9d3048e37f71b2f323681b0ad |
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\8V7CGE0O\www-tampering[1].js
| MD5 | d0a5a9e10eb7c7538c4abf5b82fda158 |
| SHA1 | 133efd3e7bb86cfb8fa08e6943c4e276e674e3a6 |
| SHA256 | a82008d261c47c8ca436773fe8d418c5e32f48fe25a30885656353461e84bbbc |
| SHA512 | a50f80003b377dbc6a22ef6b1d6ad1843ef805d94bafb1fcab8e67c3781ae671027a89c06bf279f3fd81508e18257740165a4fea3b1a7082b38ec0dc3d122c2f |
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\QRTA9FON\hcaptcha[1].js
| MD5 | c2a59891981a9fd9c791bbff1344df52 |
| SHA1 | 1bd69409a50107057b5340656d1ecd6f5726841f |
| SHA256 | 6beec8b04234097105f5d7a88af9c27552b27021446c9dbe029d908d1ff8599f |
| SHA512 | f9d556e0f7e95e603881c5196cc2aa736eb24ed62086d09d36a9e1d6b4fec9f4c1dfb125a66bec301f57230a4242108c7c255e6aa3c6f08a3a0d75e0cf288afe |
memory/3860-3079-0x0000000072360000-0x0000000072A4E000-memory.dmp
memory/3860-3081-0x0000000000650000-0x00000000012EA000-memory.dmp
memory/1732-3115-0x000001EB25820000-0x000001EB2590E000-memory.dmp
memory/1732-3120-0x00007FF9E1140000-0x00007FF9E1B2C000-memory.dmp
memory/1732-3124-0x000001EB3FE60000-0x000001EB3FE70000-memory.dmp
memory/1732-3128-0x000001EB3FD20000-0x000001EB3FE00000-memory.dmp
memory/1732-3132-0x000001EB3FEE0000-0x000001EB3FFC0000-memory.dmp
memory/1732-3139-0x000001EB3FFC0000-0x000001EB40088000-memory.dmp
memory/4312-3140-0x0000000000DD0000-0x0000000000DD1000-memory.dmp
memory/1732-3143-0x000001EB40190000-0x000001EB40258000-memory.dmp
memory/3860-3148-0x0000000072360000-0x0000000072A4E000-memory.dmp
memory/1732-3150-0x000001EB3FE00000-0x000001EB3FE4C000-memory.dmp
memory/1168-3164-0x0000000000400000-0x00000000004AA000-memory.dmp
memory/1168-3172-0x00007FF9E1140000-0x00007FF9E1B2C000-memory.dmp
memory/1732-3170-0x00007FF9E1140000-0x00007FF9E1B2C000-memory.dmp
memory/1168-3171-0x000001FF5B180000-0x000001FF5B264000-memory.dmp
memory/1168-3174-0x000001FF42900000-0x000001FF42910000-memory.dmp
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\UYKQRG1Q\suggestions[1].en-US
| MD5 | 5a34cb996293fde2cb7a4ac89587393a |
| SHA1 | 3c96c993500690d1a77873cd62bc639b3a10653f |
| SHA256 | c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad |
| SHA512 | e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee |
memory/5984-3306-0x0000000000B50000-0x0000000000B63000-memory.dmp
memory/5984-3309-0x0000000000900000-0x0000000000909000-memory.dmp
memory/5876-3313-0x0000000072360000-0x0000000072A4E000-memory.dmp
memory/4004-3315-0x0000000000400000-0x0000000000409000-memory.dmp
memory/5244-3324-0x0000000002A70000-0x0000000002E77000-memory.dmp
memory/5244-3329-0x0000000002E80000-0x000000000376B000-memory.dmp
memory/5244-3335-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/4004-3406-0x0000000000400000-0x0000000000409000-memory.dmp
memory/1168-3753-0x00007FF9E1140000-0x00007FF9E1B2C000-memory.dmp
memory/4312-3755-0x0000000000DD0000-0x0000000000DD1000-memory.dmp
memory/2968-3764-0x00007FF9E1140000-0x00007FF9E1B2C000-memory.dmp
memory/2968-3767-0x0000023CF40B0000-0x0000023CF40C0000-memory.dmp
memory/2968-3770-0x0000023CF40B0000-0x0000023CF40C0000-memory.dmp
memory/2968-3785-0x0000023CF3B10000-0x0000023CF3B32000-memory.dmp
memory/2968-3820-0x0000023CF41C0000-0x0000023CF4236000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qmynw3iy.pxf.ps1
| MD5 | c4ca4238a0b923820dcc509a6f75849b |
| SHA1 | 356a192b7913b04c54574d18c28d46e6395428ab |
| SHA256 | 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b |
| SHA512 | 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a |
memory/1168-3862-0x000001FF42900000-0x000001FF42910000-memory.dmp
memory/2968-3867-0x0000023CF40B0000-0x0000023CF40C0000-memory.dmp
memory/3480-3933-0x0000000004DE0000-0x0000000004E16000-memory.dmp
memory/3480-3938-0x0000000007460000-0x0000000007A88000-memory.dmp
memory/3480-3941-0x0000000072360000-0x0000000072A4E000-memory.dmp
memory/3480-3945-0x0000000004D90000-0x0000000004DA0000-memory.dmp
memory/3480-3943-0x0000000004D90000-0x0000000004DA0000-memory.dmp
memory/5244-3947-0x0000000002A70000-0x0000000002E77000-memory.dmp
memory/3480-3965-0x0000000007AE0000-0x0000000007B02000-memory.dmp
memory/5244-3969-0x0000000002E80000-0x000000000376B000-memory.dmp
memory/3480-3971-0x0000000007C10000-0x0000000007C76000-memory.dmp
memory/2968-3972-0x0000023CF40B0000-0x0000023CF40C0000-memory.dmp
memory/3480-3967-0x0000000007B80000-0x0000000007BE6000-memory.dmp
memory/3480-3975-0x0000000007C80000-0x0000000007FD0000-memory.dmp
memory/3480-4012-0x0000000008230000-0x000000000824C000-memory.dmp
memory/3480-4117-0x0000000008740000-0x000000000877C000-memory.dmp
memory/3480-4187-0x00000000093F0000-0x0000000009466000-memory.dmp
memory/3480-4272-0x000000000A1C0000-0x000000000A1F3000-memory.dmp
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DFB2AF638CD349F64C.TMP
| MD5 | 074d932621c0f604d6c76b76e758b220 |
| SHA1 | 37a21e641d0be3297a40680de043162bf0fa8e2e |
| SHA256 | 39caa5327fa7dbec09a008bfebe4a2c30726eb85b7579784d9c71553bdd4c5e3 |
| SHA512 | d2db28da612a83e54cdedaef945b188ad56a76ebe9d219812c61d8a1e2ea4ebe1459d3391c68547681fc9dcff45a79734206ec5038b356e44e9ec434ce877bd9 |