hxxp://google[.]com

Resubmissions

30/04/2024, 11:29

240430-nlqy3abb7w 4

30/04/2024, 10:42

30/04/2024, 10:33

30/04/2024, 10:27

30/04/2024, 10:22

Analysis

max time kernel
2040s
max time network
1925s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
30/04/2024, 11:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://google.com

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000\Software\Microsoft\Internet Explorer\GPU	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000\Software\Microsoft\Internet Explorer\GPU	wwahost.exe

Modifies data under HKEY_USERS 30 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-19	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	wwahost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "203"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-19	wwahost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 9aebff0061ccff000093fc000078d700005fba00003f9500001a6a0088179800	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\Colors\ColorHistory4 = "6160618"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	wwahost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\Colors\ColorHistory1 = "12826368"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software	wwahost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290404096"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\Colors\ColorHistory0 = "14120960"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\Colors\ColorHistory2 = "4737612"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\Colors\ColorHistory3 = "2298344"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.cloudexperienceh	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CacheVersion = "1"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DomStorageState	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\live.com\Total = "124"	wwahost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Extensible Cache	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\account.live.com	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DomStorageState	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cloudexperiencehost	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\live.com	wwahost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DomStorageState\EdpState = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DomStorageState\EdpCleanupState = "0"	wwahost.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.cloudexperienceh	wwahost.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\account.live.com	wwahost.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.cloudexperienceh	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\account.live.com\ = "0"	wwahost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\live.com\NumberOfSubdomains = "1"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\live.com\Total = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\live.com\Total = "0"	wwahost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	wwahost.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\live.com	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\live.com\NumberOfSubdomains = "1"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.cloudexperienceh	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	wwahost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	wwahost.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cloudexperiencehost	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cloudexperiencehost = "2"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "124"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cloudexperiencehost = "1"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.cloudexperienceh = "0"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\account.live.com	wwahost.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\account.live.com	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\live.com\Total = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\live.com\Total = "124"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\live.com\NumberOfSubdoma = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\account.live.com\ = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\account.live.com\ = "0"	wwahost.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cloudexperiencehost	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\live.com	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "124"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\account.live.com\ = "124"	wwahost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CacheLimit = "51200"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CacheLimit = "1"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\live.com\Total = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cloudexperiencehost = "0"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\live.com\ = "0"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\live.com	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\live.com\ = "0"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CacheVersion = "1"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CacheLimit = "1"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\live.com\ = "0"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total\ = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\account.live.com\ = "124"	wwahost.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2260	msedge.exe
2260	msedge.exe
4452	msedge.exe
4452	msedge.exe
3784	identity_helper.exe
3784	identity_helper.exe
3384	msedge.exe
3384	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3936	wwahost.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
1368	Process not Found
5852	Process not Found
4200	Process not Found
5964	Process not Found
3888	Process not Found
4892	Process not Found
4760	Process not Found
3860	Process not Found
2188	Process not Found
3728	Process not Found
1816	Process not Found
5176	Process not Found
1436	Process not Found
3564	Process not Found
5164	Process not Found
5308	Process not Found
5096	Process not Found
3596	Process not Found
3632	Process not Found
2900	Process not Found
5360	Process not Found
796	Process not Found
5184	Process not Found
1568	Process not Found
6004	Process not Found
4936	Process not Found
3428	Process not Found
5268	Process not Found
5240	Process not Found
3960	Process not Found
5172	Process not Found
4496	Process not Found
1496	Process not Found
5200	Process not Found
5564	Process not Found
2420	Process not Found
2808	Process not Found
1448	Process not Found
2488	Process not Found
1336	Process not Found
4064	Process not Found
5896	Process not Found
5644	Process not Found
504	Process not Found
1048	Process not Found
5336	Process not Found
5040	Process not Found
5716	Process not Found
3376	Process not Found
3064	Process not Found
4632	Process not Found
2204	Process not Found
4124	Process not Found
2896	Process not Found
3972	Process not Found
1824	Process not Found
2860	Process not Found
4288	Process not Found
2556	Process not Found
1740	Process not Found
5608	Process not Found
4596	Process not Found
2892	Process not Found
912	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3936	wwahost.exe
Token: SeDebugPrivilege	3936	wwahost.exe
Token: SeDebugPrivilege	3936	wwahost.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe

Suspicious use of SetWindowsHookEx 47 IoCs

pid	Process
4500	MiniSearchHost.exe
3936	wwahost.exe
3936	wwahost.exe
3936	wwahost.exe
3936	wwahost.exe
3936	wwahost.exe
3936	wwahost.exe
3936	wwahost.exe
3936	wwahost.exe
3936	wwahost.exe
3936	wwahost.exe
3936	wwahost.exe
3936	wwahost.exe
3936	wwahost.exe
3936	wwahost.exe
3936	wwahost.exe
3936	wwahost.exe
3936	wwahost.exe
3936	wwahost.exe
3936	wwahost.exe
3936	wwahost.exe
3936	wwahost.exe
3936	wwahost.exe
6100	wwahost.exe
6100	wwahost.exe
6100	wwahost.exe
6100	wwahost.exe
6100	wwahost.exe
6100	wwahost.exe
6100	wwahost.exe
6100	wwahost.exe
6100	wwahost.exe
6100	wwahost.exe
6100	wwahost.exe
6100	wwahost.exe
6100	wwahost.exe
6100	wwahost.exe
6100	wwahost.exe
6100	wwahost.exe
6100	wwahost.exe
6100	wwahost.exe
6100	wwahost.exe
6100	wwahost.exe
6100	wwahost.exe
6100	wwahost.exe
2372	SystemSettingsAdminFlows.exe
5764	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4452 wrote to memory of 32	4452	msedge.exe	80
PID 4452 wrote to memory of 32	4452	msedge.exe	80
PID 4452 wrote to memory of 1520	4452	msedge.exe	81
PID 4452 wrote to memory of 1520	4452	msedge.exe	81
PID 4452 wrote to memory of 1520	4452	msedge.exe	81
PID 4452 wrote to memory of 1520	4452	msedge.exe	81
PID 4452 wrote to memory of 1520	4452	msedge.exe	81
PID 4452 wrote to memory of 1520	4452	msedge.exe	81
PID 4452 wrote to memory of 1520	4452	msedge.exe	81
PID 4452 wrote to memory of 1520	4452	msedge.exe	81
PID 4452 wrote to memory of 1520	4452	msedge.exe	81
PID 4452 wrote to memory of 1520	4452	msedge.exe	81
PID 4452 wrote to memory of 1520	4452	msedge.exe	81
PID 4452 wrote to memory of 1520	4452	msedge.exe	81
PID 4452 wrote to memory of 1520	4452	msedge.exe	81
PID 4452 wrote to memory of 1520	4452	msedge.exe	81
PID 4452 wrote to memory of 1520	4452	msedge.exe	81
PID 4452 wrote to memory of 1520	4452	msedge.exe	81
PID 4452 wrote to memory of 1520	4452	msedge.exe	81
PID 4452 wrote to memory of 1520	4452	msedge.exe	81
PID 4452 wrote to memory of 1520	4452	msedge.exe	81
PID 4452 wrote to memory of 1520	4452	msedge.exe	81
PID 4452 wrote to memory of 1520	4452	msedge.exe	81
PID 4452 wrote to memory of 1520	4452	msedge.exe	81
PID 4452 wrote to memory of 1520	4452	msedge.exe	81
PID 4452 wrote to memory of 1520	4452	msedge.exe	81
PID 4452 wrote to memory of 1520	4452	msedge.exe	81
PID 4452 wrote to memory of 1520	4452	msedge.exe	81
PID 4452 wrote to memory of 1520	4452	msedge.exe	81
PID 4452 wrote to memory of 1520	4452	msedge.exe	81
PID 4452 wrote to memory of 1520	4452	msedge.exe	81
PID 4452 wrote to memory of 1520	4452	msedge.exe	81
PID 4452 wrote to memory of 1520	4452	msedge.exe	81
PID 4452 wrote to memory of 1520	4452	msedge.exe	81
PID 4452 wrote to memory of 1520	4452	msedge.exe	81
PID 4452 wrote to memory of 1520	4452	msedge.exe	81
PID 4452 wrote to memory of 1520	4452	msedge.exe	81
PID 4452 wrote to memory of 1520	4452	msedge.exe	81
PID 4452 wrote to memory of 1520	4452	msedge.exe	81
PID 4452 wrote to memory of 1520	4452	msedge.exe	81
PID 4452 wrote to memory of 1520	4452	msedge.exe	81
PID 4452 wrote to memory of 1520	4452	msedge.exe	81
PID 4452 wrote to memory of 2260	4452	msedge.exe	82
PID 4452 wrote to memory of 2260	4452	msedge.exe	82
PID 4452 wrote to memory of 3264	4452	msedge.exe	83
PID 4452 wrote to memory of 3264	4452	msedge.exe	83
PID 4452 wrote to memory of 3264	4452	msedge.exe	83
PID 4452 wrote to memory of 3264	4452	msedge.exe	83
PID 4452 wrote to memory of 3264	4452	msedge.exe	83
PID 4452 wrote to memory of 3264	4452	msedge.exe	83
PID 4452 wrote to memory of 3264	4452	msedge.exe	83
PID 4452 wrote to memory of 3264	4452	msedge.exe	83
PID 4452 wrote to memory of 3264	4452	msedge.exe	83
PID 4452 wrote to memory of 3264	4452	msedge.exe	83
PID 4452 wrote to memory of 3264	4452	msedge.exe	83
PID 4452 wrote to memory of 3264	4452	msedge.exe	83
PID 4452 wrote to memory of 3264	4452	msedge.exe	83
PID 4452 wrote to memory of 3264	4452	msedge.exe	83
PID 4452 wrote to memory of 3264	4452	msedge.exe	83
PID 4452 wrote to memory of 3264	4452	msedge.exe	83
PID 4452 wrote to memory of 3264	4452	msedge.exe	83
PID 4452 wrote to memory of 3264	4452	msedge.exe	83
PID 4452 wrote to memory of 3264	4452	msedge.exe	83
PID 4452 wrote to memory of 3264	4452	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc6ed53cb8,0x7ffc6ed53cc8,0x7ffc6ed53cd8
  2⤵
  PID:32
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1872,6428138056999929736,16015120843083495418,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1900 /prefetch:2
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1872,6428138056999929736,16015120843083495418,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1872,6428138056999929736,16015120843083495418,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,6428138056999929736,16015120843083495418,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,6428138056999929736,16015120843083495418,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,6428138056999929736,16015120843083495418,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4600 /prefetch:1
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,6428138056999929736,16015120843083495418,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,6428138056999929736,16015120843083495418,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1872,6428138056999929736,16015120843083495418,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5744 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,6428138056999929736,16015120843083495418,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,6428138056999929736,16015120843083495418,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3848 /prefetch:1
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1872,6428138056999929736,16015120843083495418,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1872,6428138056999929736,16015120843083495418,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5280 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,6428138056999929736,16015120843083495418,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,6428138056999929736,16015120843083495418,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,6428138056999929736,16015120843083495418,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3780 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,6428138056999929736,16015120843083495418,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,6428138056999929736,16015120843083495418,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2660 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,6428138056999929736,16015120843083495418,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1872,6428138056999929736,16015120843083495418,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  PID:5636

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2952

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1996

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:4500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4636

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:2432

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
PID:2920

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
PID:2968

C:\Windows\system32\wwahost.exe
"C:\Windows\system32\wwahost.exe" -ServerName:App.wwa
1⤵
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3936

C:\Windows\system32\wwahost.exe
"C:\Windows\system32\wwahost.exe" -ServerName:App.wwa
1⤵
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6100

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" EditUser S-1-5-21-1230210488-3096403634-4129516247-1002
1⤵
- Suspicious use of SetWindowsHookEx
PID:2372

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa39c9055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8e1dd984856ef51f4512d3bf2c7aef54

SHA1
81cb28f2153ec7ae0cbf79c04c1a445efedd125f

SHA256
34afac298a256d796d20598df006222ed6900a0dafe0f8507ed3b29bfd2027d7

SHA512
d1f8dfc7fdc5d0f185de88a420f2e5b364e77904cab99d2ace154407c4936c510f3c49e27eed4e74dd2fbd850ad129eb585a64127105661d5f8066448e9f201d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ffa07b9a59daf025c30d00d26391d66f

SHA1
382cb374cf0dda03fa67bd55288eeb588b9353da

SHA256
7052a8294dd24294974bb11e6f53b7bf36feeb62ce8b5be0c93fbee6bc034afb

SHA512
25a29d2a3ba4af0709455a9905a619c9d9375eb4042e959562af8faa087c91afafdb2476599280bbb70960af67d5bd477330f17f7345a7df729aaee997627b3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
5d8da8c3258011e30f2499a1b6f56390

SHA1
ae541bf2291913389aa5d059faff05aff2d5491a

SHA256
f16d0c6e4a8362bb96f82de7046e9a9ee3bd3ca6ebcacc3f06a38684be2a830f

SHA512
2b468f16519f24f3983c4ab8a5b712ebd937c240685c5cfbcd6cedc19ab4759997076838a46254764e2ceb193b773f6b6295814d9c18f0134a9f3548acc43967

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
e38566f83f71f220e7c91a6c2fafbf72

SHA1
43c0b56b76650cf4c135c958eefdc17d620d0406

SHA256
0a3df88dbce5df16233a12611cec547d72d20f6ecedd68082c6a811bcd988f52

SHA512
9d9329afa564a78c8dbf67efab3f0f436349185e520fd29ebc0623d8b0dba815f23976b5f633e35fa31418b88f3c3fd99a7d0deefff8ab7078868b81843ff4f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
2eafd644258354ef430f4d6f8f4348a9

SHA1
86d90dd375045ae9b2b90544c204f28d06103d1a

SHA256
a67cef0e51eeb4667068395edebec46a762f6ed82185b3392848bf1a86146774

SHA512
9585d3c6759cf8cdea848d7817f6a4a0b744c09a07e978d134f27a97eabec09ef57e03212856130f9c2b15abc035861319b1e5d2a268394a8c2029efbb34a4e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
3525127c38d0c9213c8767172d9572e6

SHA1
d7ce75e6acba66d80b12d4772d30391eddc3404e

SHA256
3920bdf2dbdaa98a98903d86478757f556112042b0c22a429332c0bcfbb915df

SHA512
7b74db0a336d29322fe56ee00b4a647183cb0a8ffe65bb26e21e91d8126d841527c767fc643e5ef262809c5fea9be1c75d728d3f890f8498b9a20280c4ed7f64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1bac48f5b09a4c3b0297fac25057dc4e

SHA1
d01e25c12fc45d73bd930dd89769a3502d1c9bc9

SHA256
f225ccdf6fb3ba6d6631a9ea3816018ff2a0b0df9a97d80ebf5ed1cf7e62e03d

SHA512
81be1bf7b2ed12c269be383255e78f487fdc946e28d6a662d2e22ea7c840700ba37be9997afa51e1ca443505264cddde508f298e70a4ccf3d1a133eacecbadf3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
949eba304993f7bfab41041d5beb9255

SHA1
4711880a5d31e401144a3036fe9bbde6e0001533

SHA256
c0128e45dce5fdf40be47f948418b6d3d3146cf5479cdb05f3a072a0c2ca003b

SHA512
1a1ad84c898b41fd78f9faa3bae0866b91bad7c34f741c3a3458765974b39b122882b9024685f68156a5dd1358f89a40fb8f89a59d44388c85f7fd81032be350

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bfde9eb74b3a0d1160fef68c6d7981ce

SHA1
4a32a06c3bb9cc7a10bcf05080edff416e96e2f7

SHA256
4698b8133bfe07835ac02522a73f787f3c33e453eef0a09b63acce8a5d346f1e

SHA512
c57030607ca9e8afad14dbc52917278fd44960357aaf9e18b1543640ccffa1cd6c5a28b0f13b705069eef1597995725b29b9668c9aea372e49534271709a8929

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
21ef0cddd249c2cd2371f37fae6f3df4

SHA1
ac7e5a3ae72f35bb501720baf15023c4fa930819

SHA256
54f4311eb191fbc5de0acece7ed92c915b12287199411ff1db41b61935bdb3ec

SHA512
39f3b261bf376a5058d89fc0f753e2eca2cf4f7b611f5caf073ae659ae89f2542d03751d901a902a9dc7896de41ccac57386680c990447239e13548f811611d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8b3024f4fe4d27a5315d16f2f0fe6e3e

SHA1
d8309eeee40697e0e5385423687157b6e0ffaaed

SHA256
8c4f02a6cd728d35f2577c639d0aa6a58e5fa9a39337054e2293587d634c87e4

SHA512
efb52fea6a5d7f3c9cc47c20db5cda0f6d6ced02f1a256372e42fe1ec28742e425ea73e47910650173cf67d268a09ceab1a452fdedd9bfa5c6f1f2586bd3af58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
23241c907b3494e2e81293caaabadcfc

SHA1
e32b2bb500376dc4fc69dc50cabb45e86c8444c6

SHA256
7b230b32d3f0a4bab4717b76d9dddb3cd93536c992c9a67463f92156fed11f82

SHA512
65891886747aa999e991589920cc9dd6036f8ab3a1b6de4b679a86ac117d45e3a5431079223842e1e111bb05d470c5438aa1bf76e84ebb702f906cb9d4ffc5c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e43483bdef6d0d390e6cd668b56367ff

SHA1
dc27feee8513b3c35248bd2e76ae04049a4d7d48

SHA256
04472384bf1967e6e36e373ca198b8259d8552d57d057f526cd45b7332ffe5b8

SHA512
a2f8a406691717cbf4fbca27e2d665aa6c010043e4d42795cb4634ba8585afea8cad57cc6aec1cecdb8d2b1fb9c1f13a7438c018dfe40a42f258660146bdbe11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ad90e529-b9e3-42dc-a306-9904f975aa3e.tmp

Filesize
977B

MD5
eae2215e4519b80b66b43d8395cb3e8b

SHA1
e242c67d6d0cfed04433fe7c3eaa3245a412f65f

SHA256
16783cad9155c5bf62d600d1e0e590652b0353283e65b63cfd9073bfbd74e114

SHA512
ed9c07bf44308decc2ece095d17d9dd6d8338a252a87960681d5dc0950d17926390a5b0fe11ffc7621ee5bb07d3ccaf29b0ba8fc01ea7ef5749e19e12c2ac8e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7513b6b12444ebb892556d79f1949f6e

SHA1
0e9ed79201d1651f92b9256f98c774b41cfea619

SHA256
e1ccf77d0cbe6bb1b6dfb4c37e173719650ceeee082073ba273d7405589b25d3

SHA512
7524361b6153db4c6a10214b4e663db4681da50020fd2869c5c71ba06af27dc5ac075ac5c3b733c48c565d14426901b080b9360e142e3b97fafc132bdbd9da7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
2c261f7bab2bd55be737cf9b18e1e8fd

SHA1
4ce48abb888c6f0dcbf071f4345ea79b1949f9b8

SHA256
c14cf2657c2fb4b20294a65d923f21fe3eb72f3c006f6a7440718ab6a6ba24c8

SHA512
f0ce11ece0e250c883734d17ca68091dd85d454e6ab068a5380e74a5b5a9efe7d0c4ffd5c17caea329c29c24e67335a1417015c07491e74b518a5b0aa98b1f3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
29a16bf3b2d407d9b9a525d48b394aa6

SHA1
715e1af706b8d06d06cf55b4fa5bfdef83912283

SHA256
786c1306ce65d729607d3c32819ab2c2b345c8c4d90ef7517c5bd4c0d08eeb2d

SHA512
8981ab47c9a4ea19f5342d7d3497881a6c899d575970ab543023d1ccc596633c24f33a406ad4b75c82bc90b5b86d10c85ade52db1390afe879ef21fed3b72edf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
d31038a6c3b6434c3f6577adcec4775d

SHA1
3fb562268408be140b245da5b6340dd9f1ba4161

SHA256
2f8dd33548b8c1b62f1767acd42291a545f0fd9b31c4eb8c16f158b261b35426

SHA512
393237a03afe36e3998f1b59828d408e334f4ced2fa2cde3a0f933026a647345a752304aa1c87601f86d029b2854ef7dd12cfe1c509c0173865e92cb7130c1a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
2c947eb9900a55d016abecfc778a9e86

SHA1
b70e17f744ac672aed398f64ac4959cd98e75e23

SHA256
ee105d98cde6c15977dbd91a4a1e143c3c01fdd73386ff16c393ec8e7b6e9e8f

SHA512
7aa37b4133e3b5963da96e6c98706dce1349071a64615cb03474e672ab693d11da8093a5b97e6eeaf4c84a0f1ff7e94e42af6de928cad60c26491f03047cafd1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2024-4-30.1133.2920.1.odl

Filesize
706B

MD5
04cddd7473a7d0e39a60a99ce622a72c

SHA1
1c8bdad2a11a14b75dcb359422418278b81427f4

SHA256
6327e8f6075e1a4791c3b2ccd46cfdc0e62027938eee9d349f681d4b4e26e57c

SHA512
89d2cd1aab7af0a2dd49b99e621b67c18b929774a48c7976b998675d35aa6a39ca015982d4ed3a5eb095c6ca1e9236431499401426cd589e2691b8c41401788e

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\JMJ3ZGEZ\converged_ux_v2_nBE5FSqn9KpH44ZlTc3VqQ2[1].css

Filesize
93KB

MD5
9c1139152aa7f4aa47e386654dcdd5a9

SHA1
5ffc6a9e66220c6f829a8bd93eba584079852992

SHA256
2518655800698c89ae0bbc34b3b362c13e558bcb3ea4bd6c2cf4bbcf9e87b927

SHA512
cbe632cbafbe7282f951fac3f5079dfc658c583f6e93a1917527c749512ff8464f95ca37337e0bfd1c96b1cf3c6ada4a3b0db89e7947261e748c55603af6ec6a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\JMJ3ZGEZ\microsoft_logo_7lyNn7YkjJOP0NwZNw6QvQ2[1].svg

Filesize
3KB

MD5
ee5c8d9fb6248c938fd0dc19370e90bd

SHA1
d01a22720918b781338b5bbf9202b241a5f99ee4

SHA256
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

SHA512
c77215b729d0e60c97f075998e88775cd0f813b4d094dc2fdd13e5711d16f4e5993d4521d0fbd5bf7150b0dbe253d88b1b1ff60901f053113c5d7c1919852d58

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\U1VUF8OH\2_vD0yppaJX3jBnfbHF1hqXQ2[1].svg

Filesize
1KB

MD5
bc3d32a696895f78c19df6c717586a5d

SHA1
9191cb156a30a3ed79c44c0a16c95159e8ff689d

SHA256
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68

SHA512
8d4f38907f3423a86d90575772b292680f7970527d2090fc005f9b096cc81d3f279d59ad76eafca30c3d4bbaf2276bbaa753e2a46a149424cf6f1c319ded5a64

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\U1VUF8OH\datarequestpackage_h-_7C7UzwdefXJT9njDBTQ2[1].js

Filesize
7KB

MD5
87effb0bb533c1d79f5c94fd9e30c14d

SHA1
4e4f5f3cddddbfddb46a1626d7ce579a639de389

SHA256
617e32ca57507098771fd30af6b9dcab063448f6d7e0bc6d6557dd1895f80543

SHA512
cb107c09f9a32d85bf2af714ee9bf7ce2649aa33e63c2255d4bbd281e3cda8fbdfa2e58212e8004aeeaab4dd8c94543f82187c7673189cacbdd5cd8c26c563f7

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\U1VUF8OH\oneds_MC5gQfpbTUjLu60sQCwU1w2[1].js

Filesize
266KB

MD5
302e6041fa5b4d48cbbbad2c402c14d7

SHA1
66273c7a4d569c1c5e566d9bf15af4bae6beeb83

SHA256
6202c1621c9126a5089e97e5c1f092c6ebd2271875015564cc73957fd5e8b758

SHA512
c7af9f4318f7836de8bfa75f7546ec704255403aba5b1fee35025b0a1d821d813bc50d75f5db2aa6bc25df62aca0a4f6515511adb6aee4a1dfcba7689fa735d7

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\YZT2G3M9\account.live[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
e91ba7113b9ee73bf73cfbf795374b4f

SHA1
beef122500329c4babf0903b183e7ecc933a234a

SHA256
71d02f8625c90f7c9499fcbc6f2335fbacf9a5fdc58b475e0ffde696de5a9c98

SHA512
7c7644a911b218d20300a51c288182312bf57e48c78faf1791c0f710451bd907721d64f3f6d26a0cac77fa7ed088b0bc084d272f4416299122adbec9896586e7

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A

Filesize
471B

MD5
f7775c96ab394fd259c17c2d4959e47e

SHA1
c6cc6e74b1c6ad5fc90741ee50b6c5e788f735bb

SHA256
082d69c7d262adebe38f3e8aac89d6cf04bf33550dc93a4fc4e51ddfe2f54ea0

SHA512
94d8f47d0ad4ad9a805f0ea1ef2b08ec992aad5a46840efce39d01709759df16999eaa651ef215097c38d6b1d47bf11fe87e99dff056069b6f190e4edad77a84

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187

Filesize
471B

MD5
c3654d1242d1783f3b25482368dc65de

SHA1
df96727844a838e194eef6af01bed57e673215c9

SHA256
a884f697f2ab5dd3b90c088702fe8a98f0c1abd01f3f919721ba653dbc538e8d

SHA512
052d77654cb917904089637f3663460e240c82ed9ee73595e6dadc4d76dcd400fb8cdadce288acd7c7dd9e015a89802c3891b4bac47dcbc40a0fc1bd78fe294a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9

Filesize
471B

MD5
95fc8cff68a40951f924a59acb66fc6b

SHA1
41997ac661b291aabe658a3256e8420c8500ca5f

SHA256
05d0dca2c63dab44ea0d9c49b444965f0e7d555611e6594cfced894c323beb45

SHA512
b6462beabe0bc56dad733ca56b099aca515282046df2c6c6180b2df4b294644ba09c61f2a5383fe25fc14a0d07eac0d7c94e1351dbd698b0b38594344fd9f721

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A

Filesize
412B

MD5
e1f5d17277d0f807e59b3df5ee4e3a1f

SHA1
2ddaf76b2c027b72c0adc587dbb3a1d2d989d762

SHA256
d9863920e2b5407d532fe705620e1ad05b6cd325079924607529151800d27dd0

SHA512
c101eb2184f65aa82fae70cb6b2dcd88e599f8225ef3b1ac5ab4798815162e98d2001cd97f1ca57b1324415d274c1fb71072ab6accce56907e7e21507b9fccf1

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187

Filesize
412B

MD5
decb8bdc42a2d98593e8a826010b76ea

SHA1
bcb9fdd50d4e8183ef9f7c683e4bd578c285779d

SHA256
201f12af6220afdf5d15ae9a97ca2ce1ac4b84cfd6a95cd33b40b6e84525001b

SHA512
2dfdf88595e2b2d90ae04a6051e7455a300895dd90bec0672b47e284b61d2235b2fb1a4d736dd0a06860c01ebe09b5f9c80de1ea0eb347dc354bc72851d391f4

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9

Filesize
420B

MD5
16d6ee1e0195114c156d4da07e0d4b50

SHA1
dd1992cd8ede1f9143a15ddd21db9ec6904170a5

SHA256
e723321d35326cdfa29cbd7e501aef853a36e142d7def53d706e20a6988ac02d

SHA512
9925a309e4ea8c43355fd4a937411d409d5ef8128cd62a4dda65e66c62bd7448485f25e9d5f9e6b5216b7619237ac99cc65c29509cd8ea0c1563ac55e30ccb7d

Download Submit
memory/2372-2942-0x000002EA6C550000-0x000002EA6C585000-memory.dmp

Filesize
212KB

Download
memory/3936-447-0x000001F2BF870000-0x000001F2BF890000-memory.dmp

Filesize
128KB

Download
memory/3936-626-0x000001F2D2CB0000-0x000001F2D2DB0000-memory.dmp

Filesize
1024KB

Download
memory/3936-564-0x000001F2C2620000-0x000001F2C2640000-memory.dmp

Filesize
128KB

Download
memory/3936-569-0x000001F2D28F0000-0x000001F2D29F0000-memory.dmp

Filesize
1024KB

Download
memory/3936-580-0x000001F2D2B20000-0x000001F2D2C20000-memory.dmp

Filesize
1024KB

Download
memory/3936-584-0x000001F2C0A30000-0x000001F2C0B30000-memory.dmp

Filesize
1024KB

Download
memory/3936-568-0x000001F2D28F0000-0x000001F2D29F0000-memory.dmp

Filesize
1024KB

Download
memory/3936-796-0x000001F2D3F00000-0x000001F2D4000000-memory.dmp

Filesize
1024KB

Download
memory/3936-802-0x000001F2D4DE0000-0x000001F2D4EE0000-memory.dmp

Filesize
1024KB

Download
memory/3936-1003-0x000001F2D6100000-0x000001F2D6200000-memory.dmp

Filesize
1024KB

Download
memory/3936-1500-0x000001F2D66B0000-0x000001F2D66D0000-memory.dmp

Filesize
128KB

Download
memory/3936-1035-0x000001F2D29F0000-0x000001F2D2A10000-memory.dmp

Filesize
128KB

Download
memory/6100-2298-0x0000025E93CA0000-0x0000025E93DA0000-memory.dmp

Filesize
1024KB

Download
memory/6100-2409-0x0000025E94360000-0x0000025E94380000-memory.dmp

Filesize
128KB

Download
memory/6100-1777-0x00000266FDC00000-0x00000266FDC20000-memory.dmp

Filesize
128KB

Download
memory/6100-1884-0x0000025E80640000-0x0000025E80660000-memory.dmp

Filesize
128KB

Download
memory/6100-1889-0x0000025E90A40000-0x0000025E90B40000-memory.dmp

Filesize
1024KB

Download
memory/6100-2792-0x0000025E943E0000-0x0000025E94400000-memory.dmp

Filesize
128KB

Download
memory/6100-2097-0x0000025E92E70000-0x0000025E92F70000-memory.dmp

Filesize
1024KB

Download
memory/6100-2091-0x0000025E91C80000-0x0000025E91D80000-memory.dmp

Filesize
1024KB

Download
memory/6100-1948-0x0000025E90DE0000-0x0000025E90EE0000-memory.dmp

Filesize
1024KB

Download
memory/6100-1899-0x0000025E90C70000-0x0000025E90D70000-memory.dmp

Filesize
1024KB

Download
memory/6100-1890-0x0000025E90A40000-0x0000025E90B40000-memory.dmp

Filesize
1024KB

Download