Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
30/04/2024, 11:29
240430-nlqy3abb7w 430/04/2024, 10:42
240430-mr7ckaab88 530/04/2024, 10:33
240430-ml1ylaaa67 430/04/2024, 10:27
240430-mhh9dahh58 430/04/2024, 10:22
240430-mefzvahg74 4Analysis
-
max time kernel
300s -
max time network
304s -
platform
windows11-21h2_x64 -
resource
win11-20240419-en -
resource tags
arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system -
submitted
30/04/2024, 10:27
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://google.com
Resource
win11-20240419-en
General
-
Target
http://google.com
Malware Config
Signatures
-
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Panther\UnattendGC\diagwrn.xml UserOOBEBroker.exe File opened for modification C:\Windows\Panther\UnattendGC\setupact.log UserOOBEBroker.exe File opened for modification C:\Windows\Panther\UnattendGC\setuperr.log UserOOBEBroker.exe File opened for modification C:\Windows\Panther\UnattendGC\diagerr.xml UserOOBEBroker.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000\Software\Microsoft\Internet Explorer\GPU wwahost.exe Key created \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000\Software\Microsoft\Internet Explorer\GPU wwahost.exe -
Modifies data under HKEY_USERS 10 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry wwahost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft wwahost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography wwahost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry wwahost.exe Key created \REGISTRY\USER\S-1-5-19\Software wwahost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography wwahost.exe Key created \REGISTRY\USER\S-1-5-19 wwahost.exe Key created \REGISTRY\USER\S-1-5-19\Software wwahost.exe Key created \REGISTRY\USER\S-1-5-19 wwahost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft wwahost.exe -
Modifies registry class 64 IoCs
description ioc Process Key deleted \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\fpt2.microsoft.com wwahost.exe Set value (int) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\fpt2.microsoft.com\ = "0" wwahost.exe Set value (str) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" wwahost.exe Key created \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\fpt2.microsoft.com wwahost.exe Key created \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cloudexperiencehost wwahost.exe Key deleted \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\login.live.com wwahost.exe Key deleted \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cloudexperiencehost wwahost.exe Key deleted \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.com wwahost.exe Key created \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\account.live.com wwahost.exe Set value (int) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\account.live.com\ = "0" wwahost.exe Key created \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings wwahost.exe Set value (int) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DomStorageState\EdpCleanupState = "0" wwahost.exe Set value (int) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\login.live.com\ = "124" wwahost.exe Set value (int) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\fpt2.microsoft.com\ = "0" wwahost.exe Set value (int) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.com\Total = "40" wwahost.exe Set value (int) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.com\Total = "0" wwahost.exe Set value (int) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CacheLimit = "51200" wwahost.exe Set value (int) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.com\ = "0" wwahost.exe Set value (int) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.com\Total = "0" wwahost.exe Key created \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total wwahost.exe Set value (int) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\live.com\Total = "0" wwahost.exe Set value (int) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\fpt2.microsoft.com\ = "0" wwahost.exe Set value (int) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.com\ = "0" wwahost.exe Set value (int) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "0" wwahost.exe Key created \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer wwahost.exe Set value (int) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\live.com\NumberOfSubdomains = "0" wwahost.exe Set value (int) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\live.com\Total = "0" wwahost.exe Key created \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total wwahost.exe Set value (int) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\live.com\NumberOfSubdomain = "0" wwahost.exe Set value (int) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.com\NumberOfSubd = "0" wwahost.exe Set value (int) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\account.live.com\ = "124" wwahost.exe Set value (int) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\account.live.com\ = "124" wwahost.exe Key created \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\fpt2.microsoft.com wwahost.exe Set value (int) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.com\Total = "0" wwahost.exe Set value (int) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.com\NumberOfSubdoma = "0" wwahost.exe Key deleted \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\account.live.com wwahost.exe Key deleted \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\login.live.com wwahost.exe Set value (int) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\live.com\Total = "0" wwahost.exe Key created \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Extensible Cache wwahost.exe Key deleted \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.cloudexperiencehos wwahost.exe Set value (int) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "0" wwahost.exe Set value (int) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\live.com\NumberOfSubdomains = "4" wwahost.exe Set value (int) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\account.live.com\ = "0" wwahost.exe Key created \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.com wwahost.exe Set value (int) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CacheVersion = "1" wwahost.exe Set value (int) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "40" wwahost.exe Set value (int) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cloudexperiencehost\N = "1" wwahost.exe Key deleted \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\fpt.live.com wwahost.exe Key created \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\signup.live.com wwahost.exe Set value (int) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.cloudexperiencehos = "0" wwahost.exe Key deleted \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\fpt2.microsoft.com wwahost.exe Set value (int) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\live.com\Total = "124" wwahost.exe Set value (str) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" wwahost.exe Set value (int) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cloudexperiencehost\ = "0" wwahost.exe Set value (int) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cloudexperiencehost\N = "0" wwahost.exe Key created \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\live.com wwahost.exe Set value (int) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\fpt.live.com\ = "0" wwahost.exe Key deleted \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cloudexperiencehost wwahost.exe Key created \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total wwahost.exe Set value (int) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.com\NumberOfSubdoma = "1" wwahost.exe Key deleted \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\live.com wwahost.exe Set value (int) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\fpt2.microsoft.com\ = "40" wwahost.exe Set value (int) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CacheVersion = "1" wwahost.exe Set value (int) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\login.live.com\ = "0" wwahost.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 2368 msedge.exe 2368 msedge.exe 3372 msedge.exe 3372 msedge.exe 4984 identity_helper.exe 4984 identity_helper.exe 5420 msedge.exe 5420 msedge.exe 5924 msedge.exe 5924 msedge.exe 5924 msedge.exe 5924 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1572 wwahost.exe Token: SeDebugPrivilege 1572 wwahost.exe Token: SeDebugPrivilege 1572 wwahost.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1572 wwahost.exe 5488 wwahost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3372 wrote to memory of 3376 3372 msedge.exe 80 PID 3372 wrote to memory of 3376 3372 msedge.exe 80 PID 3372 wrote to memory of 2420 3372 msedge.exe 81 PID 3372 wrote to memory of 2420 3372 msedge.exe 81 PID 3372 wrote to memory of 2420 3372 msedge.exe 81 PID 3372 wrote to memory of 2420 3372 msedge.exe 81 PID 3372 wrote to memory of 2420 3372 msedge.exe 81 PID 3372 wrote to memory of 2420 3372 msedge.exe 81 PID 3372 wrote to memory of 2420 3372 msedge.exe 81 PID 3372 wrote to memory of 2420 3372 msedge.exe 81 PID 3372 wrote to memory of 2420 3372 msedge.exe 81 PID 3372 wrote to memory of 2420 3372 msedge.exe 81 PID 3372 wrote to memory of 2420 3372 msedge.exe 81 PID 3372 wrote to memory of 2420 3372 msedge.exe 81 PID 3372 wrote to memory of 2420 3372 msedge.exe 81 PID 3372 wrote to memory of 2420 3372 msedge.exe 81 PID 3372 wrote to memory of 2420 3372 msedge.exe 81 PID 3372 wrote to memory of 2420 3372 msedge.exe 81 PID 3372 wrote to memory of 2420 3372 msedge.exe 81 PID 3372 wrote to memory of 2420 3372 msedge.exe 81 PID 3372 wrote to memory of 2420 3372 msedge.exe 81 PID 3372 wrote to memory of 2420 3372 msedge.exe 81 PID 3372 wrote to memory of 2420 3372 msedge.exe 81 PID 3372 wrote to memory of 2420 3372 msedge.exe 81 PID 3372 wrote to memory of 2420 3372 msedge.exe 81 PID 3372 wrote to memory of 2420 3372 msedge.exe 81 PID 3372 wrote to memory of 2420 3372 msedge.exe 81 PID 3372 wrote to memory of 2420 3372 msedge.exe 81 PID 3372 wrote to memory of 2420 3372 msedge.exe 81 PID 3372 wrote to memory of 2420 3372 msedge.exe 81 PID 3372 wrote to memory of 2420 3372 msedge.exe 81 PID 3372 wrote to memory of 2420 3372 msedge.exe 81 PID 3372 wrote to memory of 2420 3372 msedge.exe 81 PID 3372 wrote to memory of 2420 3372 msedge.exe 81 PID 3372 wrote to memory of 2420 3372 msedge.exe 81 PID 3372 wrote to memory of 2420 3372 msedge.exe 81 PID 3372 wrote to memory of 2420 3372 msedge.exe 81 PID 3372 wrote to memory of 2420 3372 msedge.exe 81 PID 3372 wrote to memory of 2420 3372 msedge.exe 81 PID 3372 wrote to memory of 2420 3372 msedge.exe 81 PID 3372 wrote to memory of 2420 3372 msedge.exe 81 PID 3372 wrote to memory of 2420 3372 msedge.exe 81 PID 3372 wrote to memory of 2368 3372 msedge.exe 82 PID 3372 wrote to memory of 2368 3372 msedge.exe 82 PID 3372 wrote to memory of 3696 3372 msedge.exe 83 PID 3372 wrote to memory of 3696 3372 msedge.exe 83 PID 3372 wrote to memory of 3696 3372 msedge.exe 83 PID 3372 wrote to memory of 3696 3372 msedge.exe 83 PID 3372 wrote to memory of 3696 3372 msedge.exe 83 PID 3372 wrote to memory of 3696 3372 msedge.exe 83 PID 3372 wrote to memory of 3696 3372 msedge.exe 83 PID 3372 wrote to memory of 3696 3372 msedge.exe 83 PID 3372 wrote to memory of 3696 3372 msedge.exe 83 PID 3372 wrote to memory of 3696 3372 msedge.exe 83 PID 3372 wrote to memory of 3696 3372 msedge.exe 83 PID 3372 wrote to memory of 3696 3372 msedge.exe 83 PID 3372 wrote to memory of 3696 3372 msedge.exe 83 PID 3372 wrote to memory of 3696 3372 msedge.exe 83 PID 3372 wrote to memory of 3696 3372 msedge.exe 83 PID 3372 wrote to memory of 3696 3372 msedge.exe 83 PID 3372 wrote to memory of 3696 3372 msedge.exe 83 PID 3372 wrote to memory of 3696 3372 msedge.exe 83 PID 3372 wrote to memory of 3696 3372 msedge.exe 83 PID 3372 wrote to memory of 3696 3372 msedge.exe 83
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.com1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8ea1e3cb8,0x7ff8ea1e3cc8,0x7ff8ea1e3cd82⤵PID:3376
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,7594831027278560836,9363418402666227793,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:22⤵PID:2420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,7594831027278560836,9363418402666227793,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1912,7594831027278560836,9363418402666227793,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:82⤵PID:3696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,7594831027278560836,9363418402666227793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3144 /prefetch:12⤵PID:3540
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,7594831027278560836,9363418402666227793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:12⤵PID:4828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,7594831027278560836,9363418402666227793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4592 /prefetch:12⤵PID:3060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,7594831027278560836,9363418402666227793,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,7594831027278560836,9363418402666227793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4008 /prefetch:12⤵PID:1592
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,7594831027278560836,9363418402666227793,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:12⤵PID:5184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,7594831027278560836,9363418402666227793,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4616 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,7594831027278560836,9363418402666227793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:12⤵PID:5652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,7594831027278560836,9363418402666227793,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:12⤵PID:5660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,7594831027278560836,9363418402666227793,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4852 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5924
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3936
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1824
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵PID:1516
-
C:\Windows\system32\wwahost.exe"C:\Windows\system32\wwahost.exe" -ServerName:App.wwa1⤵
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1572
-
C:\Windows\System32\DataExchangeHost.exeC:\Windows\System32\DataExchangeHost.exe -Embedding1⤵PID:6188
-
C:\Windows\System32\oobe\UserOOBEBroker.exeC:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding1⤵
- Drops file in Windows directory
PID:3760
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding1⤵PID:5836
-
C:\Windows\system32\CredentialEnrollmentManager.exeC:\Windows\system32\CredentialEnrollmentManager.exe1⤵PID:5440
-
C:\Windows\system32\CredentialEnrollmentManager.exeC:\Windows\system32\CredentialEnrollmentManager.exe1⤵PID:6404
-
C:\Windows\system32\CredentialEnrollmentManager.exeC:\Windows\system32\CredentialEnrollmentManager.exe1⤵PID:6612
-
C:\Windows\system32\CredentialEnrollmentManager.exeC:\Windows\system32\CredentialEnrollmentManager.exe1⤵PID:4028
-
C:\Windows\system32\CredentialEnrollmentManager.exeC:\Windows\system32\CredentialEnrollmentManager.exe1⤵PID:6640
-
C:\Windows\system32\CredentialEnrollmentManager.exeC:\Windows\system32\CredentialEnrollmentManager.exe1⤵PID:6512
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding1⤵PID:4980
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding1⤵PID:2140
-
C:\Windows\system32\wwahost.exe"C:\Windows\system32\wwahost.exe" -ServerName:App.wwa1⤵
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5488
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD58d5e555f6429eb64461265a024abf016
SHA105a5dca6408d473d82fe45ebc8e4843653ad55af
SHA2560344fd65882ba51695a10e1312e65f08d58afca83771c9d545e181829d6b5ed1
SHA512be5edfdcda1ba0db9fbab48ee1b643f1b03821e24048892d18033094fec14171035179e987a08dd91a1c25d91d9256837a4105f6765afd225a868f3e95050b8f
-
Filesize
152B
MD5b5710c39b3d1cd6dd0e5d30fbe1146d6
SHA1bf018f8a3e87605bfeca89d5a71776bfc8de0b47
SHA256770d04df1484883a18accb258ecfa407d328c32c0ccbd8866c1203c5dfb4981f
SHA5120f868e4ce284984662d8f0ff6e76f1a53e074a7223122a75efa7bb90d0204bc59bee4b36c215d219a03707c642e13f5efce0c3c57f46659a0cb1e7fd2f4d3cf1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize216B
MD5cf2b7c09579fb35eb7ec9ed8d13c6308
SHA124e83d0c3a3d6a426304a8daf238f671430e4f6b
SHA256992804781503d192c02de5451dd9101cc172ace25cba4476b12e16cb5fe37bc3
SHA5128221eb48c02071d36288e57a7bb87b53e6ef8217c072ea359d562805f9c7e220eb61e569f084ff0a1fdd1256e152cb73de9d80e48cb248ccc9c0f9c4c314a36a
-
Filesize
978B
MD59c025c7206f1b3013516fb059b6024e8
SHA118175f154f269118a46a6676264056b1c495b15d
SHA256dedec9cc6c778d946142e997309c381119e908b91b30463b605679a72b59862a
SHA5125a0798d3208662edac0e73e6842fc2e853a818a91b6e7adce0c72401640e51c2dbe947b742b8920071d83e88c278be04d9bf78f308722ceba293b1f3816ea4d7
-
Filesize
6KB
MD5ec4cc773a0c206f8f7796f8c7bf3b178
SHA173ef60c9baa3ff77f51e270fdaf1ed7e433de645
SHA256f14244ecb425091c74d88ce89dbe18113a40bf8898a6bb6d41815e9b3c2cf484
SHA5122a670e8fac20300db062497596b81cd5c91ae65026ee25490b1ec0986f1794190b3a405128da8a833a89cd94307ec6985b91b13d1e9a94e26108ce63d1de9720
-
Filesize
6KB
MD510c0a80d9e1baaae48a17dfd83120c35
SHA1104a7da30375aa542957e81ee12066a31a24795c
SHA256fe2266ccec7e4d2c4bdeb34aa55accfb0e4d803940a8cd7028ec571caa50e3ed
SHA5125c7762b2e478ef55002369552b69816698d3dce2b4fee105706f19b91095b9f1baa6a4fcaf27d5cfbf5799738adea3735803f13878b098e2722c679268fddf5b
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD587177a99dd38bd22e31225aebe966b78
SHA1508e633aa8f5686a76711f6b2f6592802d52362b
SHA256ccec015eb5ac24a6d1a4f08ca5585b40730e253871900a3b5cbe2a9eff44246b
SHA51290d89f1521bce25a7fa26d34834024f4097ad512c3875c91a8eb65875bc860ae47a773a906b72aa5151740928c32b8993eff9ec1449cf44545261693c9430cec
-
Filesize
706B
MD5a7423d4373c88f57c434e04c0b681ab3
SHA17c87d9e058c5f708ca541c6b1a50cdbbcddcc08f
SHA256e4a6948fa2648b1c7758f327155f8d2d33ab3f1284d3f0389c38f0c4ecfe0e2e
SHA51273df043df0f60225d8156121f101e44f9f037b6861ebd2d03cb13d1dffc61d4cac6e3820067e16524d9db1b90ee9da97343347a8a1354389142ba6e403acfd2b
-
Filesize
706B
MD5c77830ae1511a38618afdb74e59ac8be
SHA14800ae2f78165c03bb69bc675d8f873e25ed691c
SHA2566ce879f5296b5c7d6599e48450386bbfaaef0868588114b2db9645e380a2c4e2
SHA512d71edca8b191a8ca6ddd9bbdb7e034526ce8a47c955b7b8d46b6d1613c5c3b0910ea086a0d28e897bc6edba6c11b358f76ea00de0eea137c79b51dcbc3d0b873
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\6QXLVAVB\microsoft_logo_7lyNn7YkjJOP0NwZNw6QvQ2[1].svg
Filesize3KB
MD5ee5c8d9fb6248c938fd0dc19370e90bd
SHA1d01a22720918b781338b5bbf9202b241a5f99ee4
SHA25604d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
SHA512c77215b729d0e60c97f075998e88775cd0f813b4d094dc2fdd13e5711d16f4e5993d4521d0fbd5bf7150b0dbe253d88b1b1ff60901f053113c5d7c1919852d58
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\IRO8TQQS\datarequestpackage_h-_7C7UzwdefXJT9njDBTQ2[1].js
Filesize7KB
MD587effb0bb533c1d79f5c94fd9e30c14d
SHA14e4f5f3cddddbfddb46a1626d7ce579a639de389
SHA256617e32ca57507098771fd30af6b9dcab063448f6d7e0bc6d6557dd1895f80543
SHA512cb107c09f9a32d85bf2af714ee9bf7ce2649aa33e63c2255d4bbd281e3cda8fbdfa2e58212e8004aeeaab4dd8c94543f82187c7673189cacbdd5cd8c26c563f7
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\PL8D46DE\2_vD0yppaJX3jBnfbHF1hqXQ2[1].svg
Filesize1KB
MD5bc3d32a696895f78c19df6c717586a5d
SHA19191cb156a30a3ed79c44c0a16c95159e8ff689d
SHA2560e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
SHA5128d4f38907f3423a86d90575772b292680f7970527d2090fc005f9b096cc81d3f279d59ad76eafca30c3d4bbaf2276bbaa753e2a46a149424cf6f1c319ded5a64
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\PL8D46DE\oneds_MC5gQfpbTUjLu60sQCwU1w2[1].js
Filesize266KB
MD5302e6041fa5b4d48cbbbad2c402c14d7
SHA166273c7a4d569c1c5e566d9bf15af4bae6beeb83
SHA2566202c1621c9126a5089e97e5c1f092c6ebd2271875015564cc73957fd5e8b758
SHA512c7af9f4318f7836de8bfa75f7546ec704255403aba5b1fee35025b0a1d821d813bc50d75f5db2aa6bc25df62aca0a4f6515511adb6aee4a1dfcba7689fa735d7
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\XKI923U3\converged_ux_v2_nBE5FSqn9KpH44ZlTc3VqQ2[1].css
Filesize93KB
MD59c1139152aa7f4aa47e386654dcdd5a9
SHA15ffc6a9e66220c6f829a8bd93eba584079852992
SHA2562518655800698c89ae0bbc34b3b362c13e558bcb3ea4bd6c2cf4bbcf9e87b927
SHA512cbe632cbafbe7282f951fac3f5079dfc658c583f6e93a1917527c749512ff8464f95ca37337e0bfd1c96b1cf3c6ada4a3b0db89e7947261e748c55603af6ec6a
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\5KVVVIY5\login.live[1].xml
Filesize13B
MD5c1ddea3ef6bbef3e7060a1a9ad89e4c5
SHA135e3224fcbd3e1af306f2b6a2c6bbea9b0867966
SHA256b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db
SHA5126be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\LocalState\_sessionState.json
Filesize115B
MD5a19cd759b78f0257278ea48e6b417618
SHA12994a307e3609c3dabc52b7ea8a2cba0a0257a3a
SHA25689e4e79a21e5bfff3794d477d0997c976a66eca9ad91276bb08c77efb9953cf1
SHA51267f93708e83a73c52259503532ab9a46eacc67586080a4b1951f5e093685cd6fb26aed7218cc7d3b831f9afee0cd18c03debbbd8af6b71983c8a05b6ecada0a7
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD50a0efb3590bf89299b2ab52994ae6a66
SHA10963be535b4a1abee0fd0ae77aaee6cc1f543df5
SHA256bb2cd9921686f183de02d381e0c1c32b7eaef8181d0ca328dc197daa5229d1c7
SHA5122dd6d7823e66802d6a504f27e7cc9b9acd3997cfe10e000453d258e8da6167fb424ab91bc179fa3558a114ca64d422532fe51bbde3af680cf080afa5b66ce250
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A
Filesize471B
MD5f7775c96ab394fd259c17c2d4959e47e
SHA1c6cc6e74b1c6ad5fc90741ee50b6c5e788f735bb
SHA256082d69c7d262adebe38f3e8aac89d6cf04bf33550dc93a4fc4e51ddfe2f54ea0
SHA51294d8f47d0ad4ad9a805f0ea1ef2b08ec992aad5a46840efce39d01709759df16999eaa651ef215097c38d6b1d47bf11fe87e99dff056069b6f190e4edad77a84
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187
Filesize471B
MD5c3654d1242d1783f3b25482368dc65de
SHA1df96727844a838e194eef6af01bed57e673215c9
SHA256a884f697f2ab5dd3b90c088702fe8a98f0c1abd01f3f919721ba653dbc538e8d
SHA512052d77654cb917904089637f3663460e240c82ed9ee73595e6dadc4d76dcd400fb8cdadce288acd7c7dd9e015a89802c3891b4bac47dcbc40a0fc1bd78fe294a
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
Filesize471B
MD595fc8cff68a40951f924a59acb66fc6b
SHA141997ac661b291aabe658a3256e8420c8500ca5f
SHA25605d0dca2c63dab44ea0d9c49b444965f0e7d555611e6594cfced894c323beb45
SHA512b6462beabe0bc56dad733ca56b099aca515282046df2c6c6180b2df4b294644ba09c61f2a5383fe25fc14a0d07eac0d7c94e1351dbd698b0b38594344fd9f721
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD5e880b3bfd6101243fcedb3e41709afbb
SHA1bdf45ef567cdd3dc935c6933abd96b09b18e52a5
SHA256196f152ee4dbda53ec52612234e3d9d22da5097de0f452e1d189f96d8bdc3f5f
SHA5128a2378c4f4537818ade22e62d6d834caa2afec93068c870aff0d702f7988511d59957989da3fa449ea6b65e9f53eb47f601ca8607ab67dda98a4144893b7f4c6
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A
Filesize412B
MD539f28eb744e15281ffeddf569928c1ce
SHA1358b95c33d4401848c21414dcf8cc61498f0f2d2
SHA256675b7586e1889164a08c4cc1d31b1807d0b99a65b5c2965bebfd0554b1dbb3e9
SHA512d5e547baae0a5d6a7149abfeae9db29ea043cb58a141e56e9129de39a9a464553d49e010151681c2afcee5773bf8e1dfaadb53fc3d19a78f5c037362c42b8ec7
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187
Filesize412B
MD581ad1edbfa23a87e60478ebbd0668d2d
SHA196ea191769688638ee018575a9b4f2a921712b58
SHA2566a43b1b6f54849ac8a98dc88eb5c31e098fb9f353553ad00365f7d60d216e225
SHA51225d62bcdaa8d3b230334371655abf10c64588384af7a4264dc73ab97f22fe83dea74c6a075ff03e66f3a96d15fd6b3a8beea124f6d285d7453e85ce0d9564ba5
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
Filesize420B
MD58036f1ea609a15be503c80b02be99e41
SHA1385297af6b4fa5ec7e274ebe8e10988d99fe700e
SHA256e879f7f9556b56dfdb0b31bd23bd0eefa45e9f70b2970de55a5f208d62b02aca
SHA512ec57c40d87301883ab016149e662558f9c9f68fb56000cb8cc9eac0fcdbb56bcd00bf8ec5ff50471b8facd03d8e2005cb4d8fa3ef8f6364933a500c7c54764e2