Overview
overview
10Static
static
10a ton of y... -.exe
windows10-1703-x64
10a ton of y... -.exe
windows10-1703-x64
10a ton of y... -.exe
windows10-1703-x64
10a ton of y... -.exe
windows10-1703-x64
10a ton of y... -.exe
windows10-1703-x64
10a ton of y... -.exe
windows10-1703-x64
10a ton of y... -.exe
windows10-1703-x64
10a ton of y... -.exe
windows10-1703-x64
10a ton of y... -.exe
windows10-1703-x64
10a ton of y... -.exe
windows10-1703-x64
10a ton of y... -.exe
windows10-1703-x64
10a ton of y... -.exe
windows10-1703-x64
10a ton of y... -.exe
windows10-1703-x64
10a ton of y... -.exe
windows10-1703-x64
10a ton of y... -.exe
windows10-1703-x64
10a ton of y... -.exe
windows10-1703-x64
10a ton of y...py.exe
windows10-1703-x64
10a ton of y...py.exe
windows10-1703-x64
10a ton of y...py.exe
windows10-1703-x64
10a ton of y...py.exe
windows10-1703-x64
10a ton of y...py.exe
windows10-1703-x64
10a ton of y...py.exe
windows10-1703-x64
10a ton of y...py.exe
windows10-1703-x64
10a ton of y...py.exe
windows10-1703-x64
10a ton of y...py.exe
windows10-1703-x64
10a ton of y...py.exe
windows10-1703-x64
10a ton of y...py.exe
windows10-1703-x64
10a ton of y...py.exe
windows10-1703-x64
10a ton of y...py.exe
windows10-1703-x64
10a ton of y...py.exe
windows10-1703-x64
10a ton of y...py.exe
windows10-1703-x64
10a ton of ya/ya.exe
windows10-1703-x64
10Analysis
-
max time kernel
300s -
max time network
301s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
02/05/2024, 02:36
Behavioral task
behavioral1
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10-20240404-en
Behavioral task
behavioral5
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10-20240404-en
Behavioral task
behavioral6
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10-20240404-en
Behavioral task
behavioral7
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10-20240404-en
Behavioral task
behavioral8
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10-20240404-en
Behavioral task
behavioral9
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10-20240404-en
Behavioral task
behavioral10
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10-20240404-en
Behavioral task
behavioral11
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10-20240404-en
Behavioral task
behavioral12
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10-20240404-en
Behavioral task
behavioral13
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10-20240404-en
Behavioral task
behavioral14
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10-20240404-en
Behavioral task
behavioral15
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10-20240404-en
Behavioral task
behavioral16
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10-20240404-en
Behavioral task
behavioral17
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe
Resource
win10-20240404-en
Behavioral task
behavioral18
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe
Resource
win10-20240404-en
Behavioral task
behavioral19
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe
Resource
win10-20240404-en
Behavioral task
behavioral20
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe
Resource
win10-20240404-en
Behavioral task
behavioral21
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe
Resource
win10-20240404-en
Behavioral task
behavioral22
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe
Resource
win10-20240404-en
Behavioral task
behavioral23
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe
Resource
win10-20240404-en
Behavioral task
behavioral24
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe
Resource
win10-20240404-en
Behavioral task
behavioral25
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe
Resource
win10-20240404-en
Behavioral task
behavioral26
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy.exe
Resource
win10-20240404-en
Behavioral task
behavioral27
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy.exe
Resource
win10-20240404-en
Behavioral task
behavioral28
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy.exe
Resource
win10-20240404-en
Behavioral task
behavioral29
Sample
a ton of ya/ya - Copy - Copy - Copy.exe
Resource
win10-20240404-en
Behavioral task
behavioral30
Sample
a ton of ya/ya - Copy - Copy.exe
Resource
win10-20240404-en
Behavioral task
behavioral31
Sample
a ton of ya/ya - Copy.exe
Resource
win10-20240404-en
Behavioral task
behavioral32
Sample
a ton of ya/ya.exe
Resource
win10-20240404-en
General
-
Target
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe
-
Size
63KB
-
MD5
222c2d239f4c8a1d73c736c9cc712807
-
SHA1
c3aa61bd6f8cc640bcfa74c40d9283c9c08c7b3c
-
SHA256
ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
-
SHA512
1f2fea85e45e93916306c234b916d6b4b200dac9656e44f4555f825dd8677cb5e927bd5e7a74bf2fb2f6972a3e6e2d294a6104add162ba3d53a0e6cfedef6a02
-
SSDEEP
1536:tJc/5q1qoR5PDdAZcIED4VuCkbFybjQ9f0jQRmONww+W:7c/iqoJekbFEQ9W+mONP+W
Malware Config
Extracted
xworm
127.0.0.1:23638
209.25.140.1:5525:23638
bring-recorder.gl.at.ply.gg:23638
action-yesterday.gl.at.ply.gg:23638
147.185.221.19:23638
then-wheel.gl.at.ply.gg::23638
then-wheel.gl.at.ply.gg:23638
teen-modes.gl.at.ply.gg:23638
-
Install_directory
%LocalAppData%
-
install_file
uwumonster.exe
Signatures
-
Detect Xworm Payload 2 IoCs
resource yara_rule behavioral24/memory/1020-0-0x0000000000CE0000-0x0000000000CF6000-memory.dmp family_xworm behavioral24/files/0x000b00000001ab27-8.dat family_xworm -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Control Panel\International\Geo\Nation uxgbal.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uwumonster.lnk ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uwumonster.lnk ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe -
Executes dropped EXE 12 IoCs
pid Process 4548 uwumonster.exe 3752 uxgbal.exe 2392 uxgbal.exe 3840 uxgbal.exe 5080 uxgbal.exe 3848 uxgbal.exe 4124 uxgbal.exe 4868 uxgbal.exe 4316 uwumonster.exe 1708 uwumonster.exe 4516 uwumonster.exe 504 uwumonster.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Windows\CurrentVersion\Run\uwumonster = "C:\\Users\\Admin\\AppData\\Local\\uwumonster.exe" ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 uxgbal.exe -
Drops file in Windows directory 7 IoCs
description ioc Process File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdge.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4216 schtasks.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 9f70e4543a9cda01 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\google.com\ = "0" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.google.com\ = "0" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CacheLimit = "1" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\google.com\NumberOfSubdomain = "1" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\FileVersion = "2016061511" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CTLs MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings calc.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = ab8138fe399cda01 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CRLs MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.google.com\ = "25" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$vBulletin 4 MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "395205405" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\CTLs MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\"" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\google.com MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\Total MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\google.com\NumberOfSubdomain = "0" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 7fde16113a9cda01 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 0000000000000000 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\OneTimeCleanup = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CacheLimit = "1" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$blogger MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "25" MicrosoftEdgeCP.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2392 uxgbal.exe 2392 uxgbal.exe 4124 uxgbal.exe 3848 uxgbal.exe 3848 uxgbal.exe 4124 uxgbal.exe 5080 uxgbal.exe 5080 uxgbal.exe 2392 uxgbal.exe 2392 uxgbal.exe 3840 uxgbal.exe 3840 uxgbal.exe 2392 uxgbal.exe 3840 uxgbal.exe 2392 uxgbal.exe 3840 uxgbal.exe 5080 uxgbal.exe 5080 uxgbal.exe 3848 uxgbal.exe 3848 uxgbal.exe 4124 uxgbal.exe 4124 uxgbal.exe 4124 uxgbal.exe 3848 uxgbal.exe 3848 uxgbal.exe 4124 uxgbal.exe 5080 uxgbal.exe 5080 uxgbal.exe 3840 uxgbal.exe 3840 uxgbal.exe 2392 uxgbal.exe 2392 uxgbal.exe 2392 uxgbal.exe 3840 uxgbal.exe 2392 uxgbal.exe 3840 uxgbal.exe 5080 uxgbal.exe 4124 uxgbal.exe 5080 uxgbal.exe 4124 uxgbal.exe 3848 uxgbal.exe 3848 uxgbal.exe 4124 uxgbal.exe 3848 uxgbal.exe 4124 uxgbal.exe 3848 uxgbal.exe 5080 uxgbal.exe 5080 uxgbal.exe 3840 uxgbal.exe 3840 uxgbal.exe 2392 uxgbal.exe 2392 uxgbal.exe 2392 uxgbal.exe 3840 uxgbal.exe 2392 uxgbal.exe 3840 uxgbal.exe 5080 uxgbal.exe 5080 uxgbal.exe 3848 uxgbal.exe 3848 uxgbal.exe 4124 uxgbal.exe 4124 uxgbal.exe 3848 uxgbal.exe 4124 uxgbal.exe -
Suspicious behavior: MapViewOfSection 18 IoCs
pid Process 2580 MicrosoftEdgeCP.exe 2580 MicrosoftEdgeCP.exe 2580 MicrosoftEdgeCP.exe 2580 MicrosoftEdgeCP.exe 2580 MicrosoftEdgeCP.exe 2580 MicrosoftEdgeCP.exe 2580 MicrosoftEdgeCP.exe 2580 MicrosoftEdgeCP.exe 2580 MicrosoftEdgeCP.exe 2580 MicrosoftEdgeCP.exe 2580 MicrosoftEdgeCP.exe 2580 MicrosoftEdgeCP.exe 2580 MicrosoftEdgeCP.exe 2580 MicrosoftEdgeCP.exe 2580 MicrosoftEdgeCP.exe 2580 MicrosoftEdgeCP.exe 2580 MicrosoftEdgeCP.exe 2580 MicrosoftEdgeCP.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
description pid Process Token: SeDebugPrivilege 1020 ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe Token: SeDebugPrivilege 1020 ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe Token: SeDebugPrivilege 4548 uwumonster.exe Token: SeDebugPrivilege 3816 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 3816 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 3816 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 3816 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4316 uwumonster.exe Token: SeDebugPrivilege 2788 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 2788 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 1708 uwumonster.exe Token: 33 2728 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2728 AUDIODG.EXE Token: SeDebugPrivilege 4516 uwumonster.exe Token: SeDebugPrivilege 504 uwumonster.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 4968 MicrosoftEdge.exe 2580 MicrosoftEdgeCP.exe 3816 MicrosoftEdgeCP.exe 2580 MicrosoftEdgeCP.exe 3012 wordpad.exe 3012 wordpad.exe 3012 wordpad.exe 3012 wordpad.exe 3012 wordpad.exe 5028 OpenWith.exe 4868 uxgbal.exe 3444 OpenWith.exe 4868 uxgbal.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1020 wrote to memory of 4216 1020 ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe 73 PID 1020 wrote to memory of 4216 1020 ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe 73 PID 1020 wrote to memory of 3752 1020 ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe 77 PID 1020 wrote to memory of 3752 1020 ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe 77 PID 1020 wrote to memory of 3752 1020 ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe 77 PID 3752 wrote to memory of 2392 3752 uxgbal.exe 78 PID 3752 wrote to memory of 2392 3752 uxgbal.exe 78 PID 3752 wrote to memory of 2392 3752 uxgbal.exe 78 PID 3752 wrote to memory of 3840 3752 uxgbal.exe 79 PID 3752 wrote to memory of 3840 3752 uxgbal.exe 79 PID 3752 wrote to memory of 3840 3752 uxgbal.exe 79 PID 3752 wrote to memory of 5080 3752 uxgbal.exe 80 PID 3752 wrote to memory of 5080 3752 uxgbal.exe 80 PID 3752 wrote to memory of 5080 3752 uxgbal.exe 80 PID 3752 wrote to memory of 3848 3752 uxgbal.exe 81 PID 3752 wrote to memory of 3848 3752 uxgbal.exe 81 PID 3752 wrote to memory of 3848 3752 uxgbal.exe 81 PID 3752 wrote to memory of 4124 3752 uxgbal.exe 82 PID 3752 wrote to memory of 4124 3752 uxgbal.exe 82 PID 3752 wrote to memory of 4124 3752 uxgbal.exe 82 PID 3752 wrote to memory of 4868 3752 uxgbal.exe 83 PID 3752 wrote to memory of 4868 3752 uxgbal.exe 83 PID 3752 wrote to memory of 4868 3752 uxgbal.exe 83 PID 4868 wrote to memory of 4796 4868 uxgbal.exe 85 PID 4868 wrote to memory of 4796 4868 uxgbal.exe 85 PID 4868 wrote to memory of 4796 4868 uxgbal.exe 85 PID 2580 wrote to memory of 3536 2580 MicrosoftEdgeCP.exe 91 PID 2580 wrote to memory of 3536 2580 MicrosoftEdgeCP.exe 91 PID 2580 wrote to memory of 3536 2580 MicrosoftEdgeCP.exe 91 PID 2580 wrote to memory of 3536 2580 MicrosoftEdgeCP.exe 91 PID 2580 wrote to memory of 3536 2580 MicrosoftEdgeCP.exe 91 PID 2580 wrote to memory of 3536 2580 MicrosoftEdgeCP.exe 91 PID 2580 wrote to memory of 3536 2580 MicrosoftEdgeCP.exe 91 PID 2580 wrote to memory of 3536 2580 MicrosoftEdgeCP.exe 91 PID 2580 wrote to memory of 3536 2580 MicrosoftEdgeCP.exe 91 PID 2580 wrote to memory of 3536 2580 MicrosoftEdgeCP.exe 91 PID 2580 wrote to memory of 3536 2580 MicrosoftEdgeCP.exe 91 PID 2580 wrote to memory of 3536 2580 MicrosoftEdgeCP.exe 91 PID 2580 wrote to memory of 4384 2580 MicrosoftEdgeCP.exe 93 PID 2580 wrote to memory of 4384 2580 MicrosoftEdgeCP.exe 93 PID 2580 wrote to memory of 4384 2580 MicrosoftEdgeCP.exe 93 PID 2580 wrote to memory of 4384 2580 MicrosoftEdgeCP.exe 93 PID 2580 wrote to memory of 4384 2580 MicrosoftEdgeCP.exe 93 PID 2580 wrote to memory of 4384 2580 MicrosoftEdgeCP.exe 93 PID 2580 wrote to memory of 4384 2580 MicrosoftEdgeCP.exe 93 PID 2580 wrote to memory of 4384 2580 MicrosoftEdgeCP.exe 93 PID 2580 wrote to memory of 4384 2580 MicrosoftEdgeCP.exe 93 PID 2580 wrote to memory of 4384 2580 MicrosoftEdgeCP.exe 93 PID 2580 wrote to memory of 4384 2580 MicrosoftEdgeCP.exe 93 PID 2580 wrote to memory of 4384 2580 MicrosoftEdgeCP.exe 93 PID 2580 wrote to memory of 2848 2580 MicrosoftEdgeCP.exe 96 PID 2580 wrote to memory of 2848 2580 MicrosoftEdgeCP.exe 96 PID 2580 wrote to memory of 2848 2580 MicrosoftEdgeCP.exe 96 PID 2580 wrote to memory of 2848 2580 MicrosoftEdgeCP.exe 96 PID 2580 wrote to memory of 2848 2580 MicrosoftEdgeCP.exe 96 PID 2580 wrote to memory of 2848 2580 MicrosoftEdgeCP.exe 96 PID 2580 wrote to memory of 2848 2580 MicrosoftEdgeCP.exe 96 PID 2580 wrote to memory of 2848 2580 MicrosoftEdgeCP.exe 96 PID 2580 wrote to memory of 2848 2580 MicrosoftEdgeCP.exe 96 PID 2580 wrote to memory of 2848 2580 MicrosoftEdgeCP.exe 96 PID 2580 wrote to memory of 2848 2580 MicrosoftEdgeCP.exe 96 PID 2580 wrote to memory of 2848 2580 MicrosoftEdgeCP.exe 96 PID 4868 wrote to memory of 3012 4868 uxgbal.exe 98 PID 4868 wrote to memory of 3012 4868 uxgbal.exe 98 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\a ton of ya\ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe"C:\Users\Admin\AppData\Local\Temp\a ton of ya\ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "uwumonster" /tr "C:\Users\Admin\AppData\Local\uwumonster.exe"2⤵
- Creates scheduled task(s)
PID:4216
-
-
C:\Users\Admin\AppData\Local\Temp\uxgbal.exe"C:\Users\Admin\AppData\Local\Temp\uxgbal.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\uxgbal.exe"C:\Users\Admin\AppData\Local\Temp\uxgbal.exe" /watchdog3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2392
-
-
C:\Users\Admin\AppData\Local\Temp\uxgbal.exe"C:\Users\Admin\AppData\Local\Temp\uxgbal.exe" /watchdog3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3840
-
-
C:\Users\Admin\AppData\Local\Temp\uxgbal.exe"C:\Users\Admin\AppData\Local\Temp\uxgbal.exe" /watchdog3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5080
-
-
C:\Users\Admin\AppData\Local\Temp\uxgbal.exe"C:\Users\Admin\AppData\Local\Temp\uxgbal.exe" /watchdog3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3848
-
-
C:\Users\Admin\AppData\Local\Temp\uxgbal.exe"C:\Users\Admin\AppData\Local\Temp\uxgbal.exe" /watchdog3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4124
-
-
C:\Users\Admin\AppData\Local\Temp\uxgbal.exe"C:\Users\Admin\AppData\Local\Temp\uxgbal.exe" /main3⤵
- Checks computer location settings
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\System32\notepad.exe" \note.txt4⤵PID:4796
-
-
C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"4⤵
- Suspicious use of SetWindowsHookEx
PID:3012 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122885⤵PID:3648
-
-
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\System32\notepad.exe"4⤵PID:4548
-
-
C:\Windows\SysWOW64\calc.exe"C:\Windows\System32\calc.exe"4⤵PID:2188
-
-
C:\Windows\SysWOW64\calc.exe"C:\Windows\System32\calc.exe"4⤵
- Modifies registry class
PID:3752
-
-
-
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4548
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4968
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:948
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2580
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3816
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4316
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
PID:3536
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2788
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4384
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:1296
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1708
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
PID:2848
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x3c01⤵
- Suspicious use of AdjustPrivilegeToken
PID:2728
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:4912
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4516
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:5028
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:3444
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:504
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4980
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
654B
MD516c5fce5f7230eea11598ec11ed42862
SHA175392d4824706090f5e8907eee1059349c927600
SHA25687ba77c13905298acbac72be90949c4fe0755b6eff9777615aa37f252515f151
SHA512153edd6da59beea6cc411ed7383c32916425d6ebb65f04c65aab7c1d6b25443d143aa8449aa92149de0ad8a975f6ecaa60f9f7574536eec6b38fe5fd3a6c6adc
-
Filesize
74KB
MD5d4fc49dc14f63895d997fa4940f24378
SHA13efb1437a7c5e46034147cbbc8db017c69d02c31
SHA256853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1
SHA512cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\361MVIC5\styles__ltr[1].css
Filesize55KB
MD52c00b9f417b688224937053cd0c284a5
SHA117b4c18ebc129055dd25f214c3f11e03e9df2d82
SHA2561e754b107428162c65a26d399b66db3daaea09616bf8620d9de4bc689ce48eed
SHA5128dc644d4c8e6da600c751975ac4a9e620e26179167a4021ddb1da81b452ecf420e459dd1c23d1f2e177685b4e1006dbc5c8736024c447d0ff65f75838a785f57
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\8LLFXIMM\recaptcha__en[1].js
Filesize505KB
MD5e2e79d6b927169d9e0e57e3baecc0993
SHA11299473950b2999ba0b7f39bd5e4a60eafd1819d
SHA256231336ed913a5ebd4445b85486e053caf2b81cab91318241375f3f7a245b6c6b
SHA512d6a2ed7b19e54d1447ee9bbc684af7101b48086945a938a5f9b6ae74ace30b9a98ca83d3183814dd3cc40f251ab6433dc7f8b425f313ea9557b83e1c2e035dff
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\BLZJPBB5\favicon[1].ico
Filesize5KB
MD5f3418a443e7d841097c714d69ec4bcb8
SHA149263695f6b0cdd72f45cf1b775e660fdc36c606
SHA2566da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770
SHA51282d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\D3W3GUFA\suggestions[1].en-US
Filesize17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\361MVIC5\KFOlCnqEu92Fr1MmEU9fABc4EsA[1].woff2
Filesize9KB
MD5df648143c248d3fe9ef881866e5dea56
SHA1770cae7a298ecfe5cf5db8fe68205cdf9d535a47
SHA2566a3f2c2a5db6e4710e44df0db3caec5eb817e53989374e9eac68057d64b7f6d2
SHA5126ff33a884f4233e092ee11e2ad7ef34d36fb2b61418b18214c28aa8b9bf5b13ceccfa531e7039b4b7585d143ee2460563e3052364a7dc8d70b07b72ec37b0b66
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\361MVIC5\KFOlCnqEu92Fr1MmEU9fBBc4[1].woff2
Filesize15KB
MD5285467176f7fe6bb6a9c6873b3dad2cc
SHA1ea04e4ff5142ddd69307c183def721a160e0a64e
SHA2565a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
SHA5125f9bb763406ea8ce978ec675bd51a0263e9547021ea71188dbd62f0212eb00c1421b750d3b94550b50425bebff5f881c41299f6a33bbfa12fb1ff18c12bc7ff1
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\361MVIC5\KFOlCnqEu92Fr1MmEU9fCBc4EsA[1].woff2
Filesize1KB
MD552e881a8e8286f6b6a0f98d5f675bb93
SHA19c9c4bc1444500b298dfea00d7d2de9ab459a1ad
SHA2565e5321bb08de884e4ad6585b8233a7477fa590c012e303ea6f0af616a6e93ffb
SHA51245c07a5e511948c328f327e2ef4c3787ac0173c72c51a7e43e3efd3e47dd332539af15f3972ef1cc023972940f839fffe151aefaa04f499ae1faceaab6f1014f
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\361MVIC5\KFOlCnqEu92Fr1MmEU9fChc4EsA[1].woff2
Filesize11KB
MD516aedbf057fbb3da342211de2d071f11
SHA1fdee07631b40b264208caa8714faaa5b991d987b
SHA2567566a2f09ff8534334b7a44f72a1afaba6bdbb782209be8804636ee8b963c75f
SHA5125cd45dfb0d0ee44afd9b3ffd93c2942c2f04e359d067d4631edd67a2ee09149766294b29c75aaab7436dacc775a8ca02392c5e4cfb8d7fede19c028448507e0e
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\361MVIC5\KFOlCnqEu92Fr1MmYUtfABc4EsA[1].woff2
Filesize9KB
MD5797d1a46df56bba1126441693c5c948a
SHA101f372fe98b4c2b241080a279d418a3a6364416d
SHA256c451e5cf6b04913a0bc169e20eace7dec760ba1db38cdcc343d8673bb221dd00
SHA51299827a3fab634b2598736e338213e1041ef26108a1607be294325d90a6ba251a947fd06d8cb0a2104b26d7fe9455feb9088a79fe515be1896c994c5850705edc
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\361MVIC5\KFOlCnqEu92Fr1MmYUtfBBc4[1].woff2
Filesize14KB
MD519b7a0adfdd4f808b53af7e2ce2ad4e5
SHA181d5d4c7b5035ad10cce63cf7100295e0c51fdda
SHA256c912a9ce0c3122d4b2b29ad26bfe06b0390d1a5bdaa5d6128692c0befd1dfbbd
SHA51249da16000687ac81fc4ca9e9112bdca850bb9f32e0af2fe751abc57a8e9c3382451b50998ceb9de56fc4196f1dc7ef46bba47933fc47eb4538124870b7630036
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\361MVIC5\KFOlCnqEu92Fr1MmYUtfCBc4EsA[1].woff2
Filesize1KB
MD57cbd23921efe855138ad68835f4c5921
SHA178a3ae9ec08f2cf8ebb791a2331b33a03ab8cc76
SHA2568eaae4c8680e993b273145315c76a9a278f696467c426637d4beab8cb3dc4a3d
SHA512d8a4db91d2063273d31f77728b44557612b85f51143973caa3cfd60ab18f8c3e4b8cdaab43af843fe29441cd1d8299bf2f139a78e47bf740277b33a377377177
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\361MVIC5\KFOlCnqEu92Fr1MmYUtfCxc4EsA[1].woff2
Filesize4KB
MD5133b0f334c0eb9dbf32c90e098fab6bd
SHA1398f8fd3a668ef0b16435b01ad0c6122e3784968
SHA2566581d0d008bc695e0f6beffbd7d51abb4d063ef5dedc16feb09aa92ea20c5c00
SHA5122a5a0956ecc8680e4e9ef73ec05bc376a1cc49ddb12ee76316378fe9626dccedb21530e3e031b2dae2830874cc1b6bfd6cce2d6d0dce54587ff0fc3780041ace
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\361MVIC5\KFOmCnqEu92Fr1Mu72xKOzY[1].woff2
Filesize15KB
MD5e3836d1191745d29137bfe16e4e4a2c2
SHA14dc8845d97df9cb627d9e6fdd49be1ef9eb9a69c
SHA25698eec6c6fa4dcd4825e48eff334451979afc23cd085aea2d45b04dc1259079dd
SHA5129e9ec420cf75bf47a21e59a822e01dc89dcf97eec3cc117c54ce51923c9a6f2c462355db1bc20cdf665ef4a5b40ffcfa9c8cee05bb5e112c380038bfef29c397
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\361MVIC5\api[1].js
Filesize850B
MD5ee87fd4035a91d937ff13613982b4170
SHA1e897502e3a58c6be2b64da98474f0d405787f5f7
SHA2567649b605b4f35666df5cbcbb03597306d9215f53f61c2a097f085fa39af9859f
SHA5129e27179bdedb6fe008ab8dc0827d479c674e7e21ad44081c78782f29dd5b91ad2d5bf4f6912d6d1ad3275eedce659e26ace02f769c6b7f4b1f660a3c628feab3
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\361MVIC5\webworker[1].js
Filesize102B
MD5284b36421a1cf446f32cb8f7987b1091
SHA1eb14d6298c9da3fb26d75b54c087ea2df9f3f05f
SHA25694ab2be973685680d0be9c08d4e1a7465f3c09053cf631126bd33f49cc2f939b
SHA512093f3f5624de2e43e43eb06036107ff3260237f9e47e1f86fdfba7c7036522187a9b47b291f5443c566658a8ef555e5033c7f2ac0c9f4fa8eb69eb8e2540b372
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\6G6HBQJ3\KFOlCnqEu92Fr1MmEU9fCRc4EsA[1].woff2
Filesize14KB
MD579c7e3f902d990d3b5e74e43feb5f623
SHA144aae0f53f6fc0f1730acbfdf4159684911b8626
SHA2562236e56f735d25696957657f099459d73303b9501cc39bbd059c20849c5bedff
SHA5123a25882c7f3f90a7aa89ecab74a4be2fddfb304f65627b590340be44807c5c5e3826df63808c7cd06daa3420a94090249321a1e035b1cd223a15010c510518df
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\6G6HBQJ3\KFOmCnqEu92Fr1Mu4mxK[1].woff2
Filesize14KB
MD55d4aeb4e5f5ef754e307d7ffaef688bd
SHA106db651cdf354c64a7383ea9c77024ef4fb4cef8
SHA2563e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
SHA5127eb7c301df79d35a6a521fae9d3dccc0a695d3480b4d34c7d262dd0c67abec8437ed40e2920625e98aaeafba1d908dec69c3b07494ec7c29307de49e91c2ef48
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\6G6HBQJ3\KFOmCnqEu92Fr1Mu5mxKOzY[1].woff2
Filesize9KB
MD5efe937997e08e15b056a3643e2734636
SHA1d02decbf472a0928b054cc8e4b13684539a913db
SHA25653f2931d978bf9b24d43b5d556ecf315a6b3f089699c5ba3a954c4dde8663361
SHA512721c903e06f00840140ed5eec06329221a2731efc483e025043675b1f070b03a544f8eb153b63cd981494379a9e975f014b57c286596b6f988cee1aaf04a8c65
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\8LLFXIMM\Dahk90Fxhr1MEtfyZ-6_j6N-qVuiwfy-NjSFsUln5nQ[1].js
Filesize17KB
MD55bc0a82a24abe097e6f6c1098bef9591
SHA12da9f4ad273be56e0bfbefc24209cdeba5f9f270
SHA2560da864f7417186bd4c12d7f267eebf8fa37ea95ba2c1fcbe363485b14967e674
SHA51214351ce0be86a502718daa7a695ea4404d215af58acac418a0e7963219300f749b1feb9d7cbf3cfa088811fb5daf6948379f4421cf67b41974eab5db55924d8b
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\8LLFXIMM\KFOmCnqEu92Fr1Mu4WxKOzY[1].woff2
Filesize7KB
MD57aa7eb76a9f66f0223c8197752bb6bc5
SHA1ac56d5def920433c7850ddbbdd99d218d25afd2b
SHA2569ca415df2c57b1f26947351c66ccfaf99d2f8f01b4b8de019a3ae6f3a9c780c7
SHA512e9a513741cb90305fbe08cfd9f7416f192291c261a7843876293e04a874ab9b914c3a4d2ed771a9d6484df1c365308c9e4c35cd978b183acf5de6b96ac14480d
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\8LLFXIMM\KFOmCnqEu92Fr1Mu7GxKOzY[1].woff2
Filesize11KB
MD515d8ede0a816bc7a9838207747c6620c
SHA1f6e2e75f1277c66e282553ae6a22661e51f472b8
SHA256dbb8f45730d91bffff8307cfdf7c82e67745d84cb6063a1f3880fadfad59c57d
SHA51239c75f8e0939275a69f8d30e7f91d7ca06af19240567fb50e441a0d2594b73b6a390d11033afb63d68c86c89f4e4bf39b3aca131b30f640d21101dc414e42c97
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\8LLFXIMM\KFOmCnqEu92Fr1Mu7WxKOzY[1].woff2
Filesize5KB
MD5a835084624425dacc5e188c6973c1594
SHA11bef196929bffcabdc834c0deefda104eb7a3318
SHA2560dfa6a82824cf2be6bb8543de6ef56b87daae5dd63f9e68c88f02697f94af740
SHA51238f2764c76a545349e8096d4608000d9412c87cc0cb659cf0cf7d15a82333dd339025a4353b9bd8590014502abceb32ca712108a522ca60cbf1940d4e4f6b98a
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\8LLFXIMM\KFOmCnqEu92Fr1Mu7mxKOzY[1].woff2
Filesize1KB
MD557993e705ff6f15e722f5f90de8836f8
SHA13fecc33bac640b63272c9a8dffd3df12f996730b
SHA256836f58544471e0fb0699cb9ddd0fd0138877733a98b4e029fca1c996d4fb038d
SHA51231f92fb495a1a20ab5131493ab8a74449aabf5221e2901915f2cc917a0878bb5a3cbc29ab12324ffe2f0bc7562a142158268c3f07c7dca3e02a22a9ade41721e
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\8LLFXIMM\logo_48[1].png
Filesize2KB
MD5ef9941290c50cd3866e2ba6b793f010d
SHA14736508c795667dcea21f8d864233031223b7832
SHA2561b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
SHA512a0c69c70117c5713caf8b12f3b6e8bbb9cdaf72768e5db9db5831a3c37541b87613c6b020dd2f9b8760064a8c7337f175e7234bfe776eee5e3588dc5662419d9
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\MGPQDYAR\KFOlCnqEu92Fr1MmEU9fBxc4EsA[1].woff2
Filesize7KB
MD5207d2af0a0d9716e1f61cadf347accc5
SHA10f64b5a6cc91c575cb77289e6386d8f872a594ca
SHA256416d72c8cee51c1d6c6a1cab525b2e3b4144f2f457026669ddad34b70dabd485
SHA512da8b03ee3029126b0c7c001d7ef2a7ff8e6078b2df2ec38973864a9c0fd8deb5ecef021c12a56a24a3fd84f38f4d14ea995df127dc34f0b7eec8e6e3fc8d1bbd
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\MGPQDYAR\KFOlCnqEu92Fr1MmEU9fCxc4EsA[1].woff2
Filesize5KB
MD56bef514048228359f2f8f5e0235f8599
SHA1318cb182661d72332dc8a8316d2e6df0332756c4
SHA256135d563a494b1f8e6196278b7f597258a563f1438f5953c6fbef106070f66ec8
SHA51223fb4605a90c7616117fab85fcd88c23b35d22177d441d01ce6270a9e95061121e0f7783db275ad7b020feaba02bbbc0f77803ca9fb843df6f1b2b7377288773
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\MGPQDYAR\KFOlCnqEu92Fr1MmYUtfBxc4EsA[1].woff2
Filesize7KB
MD5585f849571ef8c8f1b9f1630d529b54d
SHA1162c5b7190f234d5f841e7e578b68779e2bf48c2
SHA256c6dcdefaa63792f3c29abc520c8a2c0bc6e08686ea0187c9baac3d5d329f7002
SHA5121140c4b04c70a84f1070c27e8e4a91d02fda4fc890877900c53cfd3a1d8908b677a412757061de43bc71022dfdd14288f9db0852ef6bf4d2c1615cb45628bebc
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\MGPQDYAR\KFOlCnqEu92Fr1MmYUtfCRc4EsA[1].woff2
Filesize14KB
MD5e904f1745726f4175e96c936525662a7
SHA1af4e9ee282fea95be6261fc35b2accaed24f6058
SHA25665c7b85c92158adb2d71bebe0d6dfb31ab34de5e7d82134fe1aa4eba589fc296
SHA5127a279d41c8f60806c2253cba5b399be7add861bd15bf0ac4fa7c96fa1eee6557bf1ebd684e909086d9292739f27fa18947af5c98f4920fe00da3acf209c6260a
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\MGPQDYAR\KFOlCnqEu92Fr1MmYUtfChc4EsA[1].woff2
Filesize11KB
MD529542ac824c94a70cb8abdeef41cd871
SHA1df5010dad18d6c8c0ad66f6ff317729d2c0090ba
SHA25663ef838f895e018722b60f6e7e1d196ff3d90014c70465703fc58e708e83af64
SHA51252f91e02b82f9f27d334704b62a78e746c80023ee8882b96cb24cb4043f9a256f395d24830b1f4513bd7597f8c564af20db9c715ab014eb2ab752fd697156591
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\7J9XEWNA\www.google[1].xml
Filesize99B
MD507765b657d3b997502651bb00ad305c9
SHA1fa48eddbc07a3a0111c38500fd0075a1df55030f
SHA256ddb764b4adfa148ede9acb1aef429cbaaa5805f35b30dda5304e876b4ae090b5
SHA5125b82dc123183b18d20b9575d60512f136ce1c19af69c5e6f24b36f4e224c39e443c9c0ab8fdcb65d6635dae0481baa8734abef760bc98953f0db2089919d212b
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize1KB
MD5a240d3899f5c942fa4d758eaa3f6cffd
SHA1ab28b7e179d0b320b32b40f9302c6692bab2f06e
SHA256fd668a44e7e00cb370d96f1ed1de4a6853f0fe2679fbb5e9cc211450d7cd6111
SHA5128d774eda4fba5de333e50be8503c902c5f8aa6bc4516a0cad95f8cb8d697924fb88696b22cc712c6468ee9e8866a29c71d24f16d4e19dd0ded38069602babeee
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize724B
MD5ac89a852c2aaa3d389b2d2dd312ad367
SHA18f421dd6493c61dbda6b839e2debb7b50a20c930
SHA2560b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45
SHA512c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_D7C1EE155B4C5E8C9EE3042DF21F688A
Filesize472B
MD5d82886e4da51cd825189e243de66e640
SHA1edc8290b23161653889b252b37f19ec019720941
SHA2563d47798cbe8f8488ea79b1ef3fa8e9c89a17ccea4f2305be794601878e3cde73
SHA512ba84e29c4e2a374bb2b836e4dc40ff52db54159c0145f4b1f90927953e285d72a25f358f4ada1450ac4f09f48d7dcb1d7ff77aac5670fea4678094bb3a3c5ed4
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize410B
MD51e602a082419031e1076765c1e86a5ca
SHA1added54ca53d634ebbb36856f730297c8e1eac20
SHA2565f38db63fd3d6e65710db2745eb41a1cf20bd8a07cf847a185523dfa7470fc48
SHA5127ec9d8d65cfecb3ccb46048622d996689d0da719b843b81e5e76b52b6d51d393f414c9f99189bd08a156f1487b1fafd0bacffb3daf47c918bb3b6076f273a305
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize392B
MD55db98e4d6a8709499a5b7c91053a9823
SHA1027ad0f4164cf816bc783bd1fb3c348ce013f628
SHA256f74cf1343a8e00ef332ca5a7a0e2e7842db2b5c811561430269e5325759acd3e
SHA5122204401a746b59693f1abf7d0e935c861ec3bc26d411197cf0038d9f369b4a689301fb60c487f54accc615e2b8cb82560eee6403be7c5e7911f693a228c6ee1f
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_D7C1EE155B4C5E8C9EE3042DF21F688A
Filesize414B
MD5e9a29c5500a422e235697d063a4f5133
SHA19d39ebf5019b748e33e094c1349b0b0562a60870
SHA256264e6482a2664436e9b8b4cf2838899d96ec06ff7f3976051f8b0c1a44c02bf2
SHA512680eed931b1caf5751c3f2a24de220a8aeb3e6308ac4c62042be7b1e4a38d23470086aa6e95564b7aae34fc672ac2c7867381d192474e4e7f38e8f9384e8c75c
-
Filesize
16KB
MD51d5ad9c8d3fee874d0feb8bfac220a11
SHA1ca6d3f7e6c784155f664a9179ca64e4034df9595
SHA2563872c12d31fc9825e8661ac01ecee2572460677afbc7093f920a8436a42e28ff
SHA512c8246f4137416be33b6d1ac89f2428b7c44d9376ac8489a9fbf65ef128a6c53fb50479e1e400c8e201c8611992ab1d6c1bd3d6cece89013edb4d35cdd22305b1
-
Filesize
63KB
MD5222c2d239f4c8a1d73c736c9cc712807
SHA1c3aa61bd6f8cc640bcfa74c40d9283c9c08c7b3c
SHA256ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
SHA5121f2fea85e45e93916306c234b916d6b4b200dac9656e44f4555f825dd8677cb5e927bd5e7a74bf2fb2f6972a3e6e2d294a6104add162ba3d53a0e6cfedef6a02
-
Filesize
218B
MD5afa6955439b8d516721231029fb9ca1b
SHA1087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA2568e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
SHA5125da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf