hxxp://Abcacbac

Analysis

max time kernel
236s
max time network
226s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2024 06:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://Abcacbac

Score

5^/10

microsoft discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand MICROSOFT.
phishing microsoft
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\GPU	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\GPU	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	wwahost.exe

Modifies data under HKEY_USERS 25 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software	wwahost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "218"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft	wwahost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-19	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography	wwahost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\account.live.com\ = "124"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total\ = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "124"	wwahost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "18874385"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\account.live.com\ = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\fpt2.microsoft.com\ = "0"	wwahost.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.com	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\account.live.com	wwahost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CacheLimit = "1"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DomStorageState\EdpState = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.com\Total = "0"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Extensible Cache	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\live.com	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\live.com\Total = "124"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\fpt2.microsoft.com\ = "40"	wwahost.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_CLASSES\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPCONTAINER\STORAGE\MICROSOFT.WINDOWS.CLOUDEXPERIENCEHOST_CW5N1H2TXYEWY\INTERNET EXPLORER\DOMSTORAGE\FPT.LIVE.COM	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\live.com\Total = "0"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cloudexperiencehost\ = "0"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	wwahost.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_CLASSES\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPCONTAINER\STORAGE\MICROSOFT.WINDOWS.CLOUDEXPERIENCEHOST_CW5N1H2TXYEWY\INTERNET EXPLORER\DOMSTORAGE\LIVE.COM	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content	wwahost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer	wwahost.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.cloudexperienceho	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\account.live.com\ = "0"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\fpt.live.com	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DomStorageState	wwahost.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_CLASSES\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPCONTAINER\STORAGE\MICROSOFT.WINDOWS.CLOUDEXPERIENCEHOST_CW5N1H2TXYEWY\INTERNET EXPLORER\EDPDOMSTORAGE\LIVE.COM	wwahost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	wwahost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\live.com\Total = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\live.com\NumberOfSubdomains = "2"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\live.com\NumberOfSubdomains = "1"	wwahost.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_CLASSES\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPCONTAINER\STORAGE\MICROSOFT.WINDOWS.CLOUDEXPERIENCEHOST_CW5N1H2TXYEWY\INTERNET EXPLORER\DOMSTORAGE\TOTAL	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\live.com\Total = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cloudexperiencehost\ = "2"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\live.com\NumberOfSubdomains = "0"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.com	wwahost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	wwahost.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cloudexperiencehost	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\live.com\Total = "124"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cloudexperiencehost\ = "1"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CacheLimit = "1"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\fpt.live.com\ = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.com\NumberOfSubdom = "0"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings	wwahost.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
6120	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3616	msedge.exe
3616	msedge.exe
2360	msedge.exe
2360	msedge.exe
320	identity_helper.exe
320	identity_helper.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5168	taskmgr.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
6892	Process not Found
5768	Process not Found
7160	Process not Found
5536	Process not Found
4740	Process not Found
1208	Process not Found
5652	Process not Found
464	Process not Found
1104	Process not Found
6760	Process not Found
3424	Process not Found
6940	Process not Found
964	Process not Found
7132	Process not Found
2532	Process not Found
1956	Process not Found
3732	Process not Found
6856	Process not Found
4468	Process not Found
5900	Process not Found
5780	Process not Found
5288	Process not Found
4804	Process not Found
5280	Process not Found
4040	Process not Found
4536	Process not Found
768	Process not Found
3776	Process not Found
2112	Process not Found
1368	Process not Found
4148	Process not Found
1164	Process not Found
6216	Process not Found
6116	Process not Found
6292	Process not Found
4912	Process not Found
3416	Process not Found
5428	Process not Found
5296	Process not Found
3360	Process not Found
4224	Process not Found
4212	Process not Found
5860	Process not Found
3932	Process not Found
4196	Process not Found
1384	Process not Found
2312	Process not Found
2576	Process not Found
5312	Process not Found
6108	Process not Found
6164	Process not Found
5788	Process not Found
1092	Process not Found
884	Process not Found
5868	Process not Found
6852	Process not Found
5424	Process not Found
972	Process not Found
6788	Process not Found
5164	Process not Found
2100	Process not Found
1176	Process not Found
3784	Process not Found
3856	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	5168	taskmgr.exe
Token: SeSystemProfilePrivilege	5168	taskmgr.exe
Token: SeCreateGlobalPrivilege	5168	taskmgr.exe
Token: SeShutdownPrivilege	5168	taskmgr.exe
Token: SeCreatePagefilePrivilege	5168	taskmgr.exe
Token: SeManageVolumePrivilege	1168	svchost.exe
Token: SeDebugPrivilege	4448	wwahost.exe
Token: SeDebugPrivilege	4448	wwahost.exe
Token: SeDebugPrivilege	4448	wwahost.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe
5168	taskmgr.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
348	AccountsControlHost.exe
4448	wwahost.exe
372	wwahost.exe
372	wwahost.exe
372	wwahost.exe
372	wwahost.exe
372	wwahost.exe
372	wwahost.exe
372	wwahost.exe
6176	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 1596	2360	msedge.exe	82
PID 2360 wrote to memory of 1596	2360	msedge.exe	82
PID 2360 wrote to memory of 3960	2360	msedge.exe	83
PID 2360 wrote to memory of 3960	2360	msedge.exe	83
PID 2360 wrote to memory of 3960	2360	msedge.exe	83
PID 2360 wrote to memory of 3960	2360	msedge.exe	83
PID 2360 wrote to memory of 3960	2360	msedge.exe	83
PID 2360 wrote to memory of 3960	2360	msedge.exe	83
PID 2360 wrote to memory of 3960	2360	msedge.exe	83
PID 2360 wrote to memory of 3960	2360	msedge.exe	83
PID 2360 wrote to memory of 3960	2360	msedge.exe	83
PID 2360 wrote to memory of 3960	2360	msedge.exe	83
PID 2360 wrote to memory of 3960	2360	msedge.exe	83
PID 2360 wrote to memory of 3960	2360	msedge.exe	83
PID 2360 wrote to memory of 3960	2360	msedge.exe	83
PID 2360 wrote to memory of 3960	2360	msedge.exe	83
PID 2360 wrote to memory of 3960	2360	msedge.exe	83
PID 2360 wrote to memory of 3960	2360	msedge.exe	83
PID 2360 wrote to memory of 3960	2360	msedge.exe	83
PID 2360 wrote to memory of 3960	2360	msedge.exe	83
PID 2360 wrote to memory of 3960	2360	msedge.exe	83
PID 2360 wrote to memory of 3960	2360	msedge.exe	83
PID 2360 wrote to memory of 3960	2360	msedge.exe	83
PID 2360 wrote to memory of 3960	2360	msedge.exe	83
PID 2360 wrote to memory of 3960	2360	msedge.exe	83
PID 2360 wrote to memory of 3960	2360	msedge.exe	83
PID 2360 wrote to memory of 3960	2360	msedge.exe	83
PID 2360 wrote to memory of 3960	2360	msedge.exe	83
PID 2360 wrote to memory of 3960	2360	msedge.exe	83
PID 2360 wrote to memory of 3960	2360	msedge.exe	83
PID 2360 wrote to memory of 3960	2360	msedge.exe	83
PID 2360 wrote to memory of 3960	2360	msedge.exe	83
PID 2360 wrote to memory of 3960	2360	msedge.exe	83
PID 2360 wrote to memory of 3960	2360	msedge.exe	83
PID 2360 wrote to memory of 3960	2360	msedge.exe	83
PID 2360 wrote to memory of 3960	2360	msedge.exe	83
PID 2360 wrote to memory of 3960	2360	msedge.exe	83
PID 2360 wrote to memory of 3960	2360	msedge.exe	83
PID 2360 wrote to memory of 3960	2360	msedge.exe	83
PID 2360 wrote to memory of 3960	2360	msedge.exe	83
PID 2360 wrote to memory of 3960	2360	msedge.exe	83
PID 2360 wrote to memory of 3960	2360	msedge.exe	83
PID 2360 wrote to memory of 3616	2360	msedge.exe	84
PID 2360 wrote to memory of 3616	2360	msedge.exe	84
PID 2360 wrote to memory of 5108	2360	msedge.exe	85
PID 2360 wrote to memory of 5108	2360	msedge.exe	85
PID 2360 wrote to memory of 5108	2360	msedge.exe	85
PID 2360 wrote to memory of 5108	2360	msedge.exe	85
PID 2360 wrote to memory of 5108	2360	msedge.exe	85
PID 2360 wrote to memory of 5108	2360	msedge.exe	85
PID 2360 wrote to memory of 5108	2360	msedge.exe	85
PID 2360 wrote to memory of 5108	2360	msedge.exe	85
PID 2360 wrote to memory of 5108	2360	msedge.exe	85
PID 2360 wrote to memory of 5108	2360	msedge.exe	85
PID 2360 wrote to memory of 5108	2360	msedge.exe	85
PID 2360 wrote to memory of 5108	2360	msedge.exe	85
PID 2360 wrote to memory of 5108	2360	msedge.exe	85
PID 2360 wrote to memory of 5108	2360	msedge.exe	85
PID 2360 wrote to memory of 5108	2360	msedge.exe	85
PID 2360 wrote to memory of 5108	2360	msedge.exe	85
PID 2360 wrote to memory of 5108	2360	msedge.exe	85
PID 2360 wrote to memory of 5108	2360	msedge.exe	85
PID 2360 wrote to memory of 5108	2360	msedge.exe	85
PID 2360 wrote to memory of 5108	2360	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://Abcacbac
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9f7dc46f8,0x7ff9f7dc4708,0x7ff9f7dc4718
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,2874573312434201714,6832610675483437662,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,2874573312434201714,6832610675483437662,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,2874573312434201714,6832610675483437662,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2874573312434201714,6832610675483437662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3136 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2874573312434201714,6832610675483437662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2874573312434201714,6832610675483437662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4612 /prefetch:1
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2874573312434201714,6832610675483437662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,2874573312434201714,6832610675483437662,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4100 /prefetch:8
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,2874573312434201714,6832610675483437662,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4100 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2874573312434201714,6832610675483437662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2874573312434201714,6832610675483437662,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2874573312434201714,6832610675483437662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2874573312434201714,6832610675483437662,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:5436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2874573312434201714,6832610675483437662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3012 /prefetch:1
  2⤵
  PID:6008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2874573312434201714,6832610675483437662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:6540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,2874573312434201714,6832610675483437662,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5548 /prefetch:2
  2⤵
  PID:6892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4200

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2772

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5168

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:5992

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
PID:6120

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1168

C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\AccountsControlHost.exe
"C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\AccountsControlHost.exe" -ServerName:App.AppX20qnn98vxw5bhxrjtb1f6rggecb2k15a.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:348

C:\Windows\system32\wwahost.exe
"C:\Windows\system32\wwahost.exe" -ServerName:App.wwa
1⤵
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultf36d5699h8f7ch439dh89f2h2ff29352e374
1⤵
PID:6980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ff9f7dc46f8,0x7ff9f7dc4708,0x7ff9f7dc4718
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,17193012614056596079,9967264442963032386,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2004 /prefetch:2
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,17193012614056596079,9967264442963032386,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  PID:5644

C:\Windows\system32\wwahost.exe
"C:\Windows\system32\wwahost.exe" -ServerName:App.wwa
1⤵
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:372

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3937055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:6176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56a4f78e21616a6e19da57228569489b

SHA1
21bfabbfc294d5f2aa1da825c5590d760483bc76

SHA256
d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb

SHA512
c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
390c19203f97c52758d1dd26c828d666

SHA1
98b32ed9a10b61774d3172086a87890e7a4ce3e3

SHA256
a2e06dbacd8cd632b1d3f23ac50f2b5beea948c0861ad7aa7c0816f4811c4efa

SHA512
b88fc7b850a8b168f777954749bd739d0cfe129f397d56080c16e24a92a90877cc732b3fcf166bee46ee1ef822e198c237a37478e9bad14564a17b4fa6302f46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e443ee4336fcf13c698b8ab5f3c173d0

SHA1
9bf70b16f03820cbe3158e1f1396b07b8ac9d75a

SHA256
79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b

SHA512
cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bd6ab5426e432ba300e0ca45c9aa1ecc

SHA1
923b81e600a46b89b56805baffe32423b9afcc33

SHA256
d37d1b80df86e4a920f45a86f9aee9a6732f28dc1ad6e19dbe70088cad8301f5

SHA512
d8ac3b39501c4715b63dadaa7ff0bdac24c82cc96b091f7d1962ea8d71b758a70379250356bb91c7cc7b47728e2183b0bf0ff21a0cf156d641a0ad9658bd555c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b907d0ae238ddac98bbf6687ff41a353

SHA1
9688fc3840d2454cb27ec022cdd5c1428ebb5901

SHA256
e6c61d184ce7fcbdd94ff99c5ec6ac2256f10e5d74bf1bd1f22f5cd530a8f389

SHA512
225d34b922584f8818084117da1eabcaeb7840709bc3b55e1dfac687d4c1b720ad5e46c51aabd3345db82a8e0a8d7c852843225b574842645ddd90c817cbbbe5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8cc933807b16c1e494a130cfc575713a

SHA1
f25f9b988927e7bcc663184e518123a02c6c6039

SHA256
2f5b772b5308b3ab6840ff5cd0e4108918866d64af9aeddea9ffc57b5bbbda7e

SHA512
3c62b2684270950907fb8fba19af974cbee555f125a893020ad6ee54ac32e3c1905428ba11fb245f73e6a6dc84f00ee762ad90b95f7644e71ea210a02268503c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5ca2fa973ed82c47b0f345fab4a680b9

SHA1
544b3984aa31d2b48dbee55b18619ae6a6f05274

SHA256
4916976d001b3eb695584d4716e9c1884c5f9de3bed7f7d17bfae956dfd07b6d

SHA512
ae445547ce2c80104d8bf61197869b4e16223d09f3fcb7999b27ba8a2bdd3189bbff5af07a0040c7d3ba8ea37629d6a6812a9ad28c3a1daca670a21877f172d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b7cd1550bfd95dd3f11967317c82b465

SHA1
f4e458aedd46b5b1b70f59b4fb4233db19bafe8e

SHA256
d923faf9d6b2b8abeec477d1af810e7fd4c8ec64956380c837c1422eec67b16d

SHA512
b45fb881fb16a906f1976e4aacea3cef2886eb96bfd1d5e95b185e990d48acc23dcaa6953982e0be1971c4db59b246e15ce5f99036f92dd0b583402b1be0925d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
28a9027b28c3509d654f77d833359604

SHA1
c2e084edbd7d872926311d5372ea04ef9b598131

SHA256
95bf6b9337d0ef6f5b8a17131cf6c10c2341d49974f93e2854ccbc61d7d44fd2

SHA512
f8d75310da0f13a179d16a02616b03fdefb47dcf130061c76ea153801bf4dc65d1c7a8f4d286915035329f7052a103d17d50de6497a8b34f8659aab310d49d0e

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\B3EFYZ2Y\datarequestpackage_WhkJOChfZHHxzLggwuParw2[1].js

Filesize
7KB

MD5
5a190938285f6471f1ccb820c2e3daaf

SHA1
27dd715f7d1d143f21530650971ca8924f0399b7

SHA256
ee4180842490651a8e31cb587a0fd51cd3f14bda61da34cbbe84af5e56cb3455

SHA512
960b0a6aa35312570f7f661d55960a66f849b436401756977c4d5dab45a0e6bbea67bf42c21002aacf9335af1d0d39e4534ecd8fa0bb09927df0f018f68366d7

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\BFO32THF\oneds_MC5gQfpbTUjLu60sQCwU1w2[1].js

Filesize
266KB

MD5
302e6041fa5b4d48cbbbad2c402c14d7

SHA1
66273c7a4d569c1c5e566d9bf15af4bae6beeb83

SHA256
6202c1621c9126a5089e97e5c1f092c6ebd2271875015564cc73957fd5e8b758

SHA512
c7af9f4318f7836de8bfa75f7546ec704255403aba5b1fee35025b0a1d821d813bc50d75f5db2aa6bc25df62aca0a4f6515511adb6aee4a1dfcba7689fa735d7

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\OV0CQTAP\converged_ux_v2_nBE5FSqn9KpH44ZlTc3VqQ2[1].css

Filesize
93KB

MD5
9c1139152aa7f4aa47e386654dcdd5a9

SHA1
5ffc6a9e66220c6f829a8bd93eba584079852992

SHA256
2518655800698c89ae0bbc34b3b362c13e558bcb3ea4bd6c2cf4bbcf9e87b927

SHA512
cbe632cbafbe7282f951fac3f5079dfc658c583f6e93a1917527c749512ff8464f95ca37337e0bfd1c96b1cf3c6ada4a3b0db89e7947261e748c55603af6ec6a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\OV0CQTAP\microsoft_logo_7lyNn7YkjJOP0NwZNw6QvQ2[1].svg

Filesize
3KB

MD5
ee5c8d9fb6248c938fd0dc19370e90bd

SHA1
d01a22720918b781338b5bbf9202b241a5f99ee4

SHA256
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

SHA512
c77215b729d0e60c97f075998e88775cd0f813b4d094dc2fdd13e5711d16f4e5993d4521d0fbd5bf7150b0dbe253d88b1b1ff60901f053113c5d7c1919852d58

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\XMUGAJWG\2_vD0yppaJX3jBnfbHF1hqXQ2[1].svg

Filesize
1KB

MD5
bc3d32a696895f78c19df6c717586a5d

SHA1
9191cb156a30a3ed79c44c0a16c95159e8ff689d

SHA256
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68

SHA512
8d4f38907f3423a86d90575772b292680f7970527d2090fc005f9b096cc81d3f279d59ad76eafca30c3d4bbaf2276bbaa753e2a46a149424cf6f1c319ded5a64

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\O3SHTU7L\account.live[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\LocalState\_sessionState.json

Filesize
117B

MD5
6da9978b3c1d2ce97ec3912c11cba0a9

SHA1
1e1c095c35a5148cb44e078cf35bd75fd3e27b79

SHA256
5977a6b1614e855535909371271e0a2d08a08aa6330407cdf70b0dbde4c277c4

SHA512
22815edd3557085a782bef7fbb6b6986b9422172e19176cd44cb0bcd9aa1c6851c15b8168ee783d7b1fd53ef62e59295a6f77eccd72cd7a2366f50ca8c956d6b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A

Filesize
471B

MD5
807300eea2e952ed97b93bbc85627ee1

SHA1
baa0c1a056a1812551c706189da8cc7f7335d657

SHA256
84b78500915127b1021e19cef272c957f769d2518c67d8cd97d6431c7a21f21d

SHA512
838d39b5e7197d14938c9bf6c606830eab03496821c0e89f1390bf2eef2f5e7b3283559984997fe973c3aedb75fc4f91f4baf34f354cb9260fceccde4a813a9c

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187

Filesize
471B

MD5
caef077d66c221893087d1ad349e5d62

SHA1
3ebe231961d42cab59d964e8e6d3dd6e4661f488

SHA256
efe74e079611353dd865f323bd3cda14dd9862c7a3b9099b1bc47012aabee255

SHA512
75797f3b950ee7c5aea5556b672f3271107e5a7e7fc96741d5fd0fd492eefa9ee355dab99d8e5a116a78a3dc94bab4b38179aff9aee45c15e5958ad7b8caa1f5

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9

Filesize
471B

MD5
8909d638e007b4d24fdfcbe44c0caa52

SHA1
51b53cb9cb34aa0b9179bc7ddec7ffaa945ebcd0

SHA256
84a13fa3f4c2dc8020fcf343c3362d995d545ba3895e63d08f6ed7fe430687cb

SHA512
29a4be4ca8dda580707497aa4f662aeb8619fc19801d35099bb08d9e0ecbf0cea981acbc2085c6c6ccb61ac6e12e41038ddbdf0d3a1dd687bf73d0ea682ca99a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A

Filesize
412B

MD5
9b19c59384242402eadef2a1e224533c

SHA1
7cdc7e90ce7b9411d0b93c80703e4f76e93173e4

SHA256
2660e459e6bc79e0568f01f2992e84244c6eee9531a25a5786d4f1e204574aab

SHA512
0f0df9224abddd6e95f7062b32f8eb11ef4ded15559b0b51791d4218fbd353eee17887331d2cfa8f012d57f1231a5aeeea596d90e2f3f8152d5b4a506cd24dfb

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187

Filesize
412B

MD5
f8d6eb888fc87bd03f2bba8f5739f6cb

SHA1
64778e3d5160339897cf81aa2bd18cc932aa38d8

SHA256
0411a209fa40d0719acf902f17f4a8717155265cb260d9c5f500e39c4bf7d4a0

SHA512
ecbd9d4ba6d828eed1dd60001cc949d70a46af70898e497f2766d08cda9d9a8007f57d1627e500030d73105225bda42b85e890aa89895e6b6384b112bb31a832

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9

Filesize
420B

MD5
861f522b9d27853cff012e8d913474c5

SHA1
781762de2e26e827268f7c31d4c8ddc5e6934e43

SHA256
bf5b3d2240ffc90fd8e18617ed4e0927cda7d1066ae72982525a413b5a5d46ae

SHA512
784ce8df0efe5cfbc233cdebadb79b6f0affe5cad6081a080fb49f23060ba511b1e2dbd1f3051de94fd2612ffc9c8085dde05d1995594412cbc6e08165d1c54f

Download Submit
memory/1168-137-0x00000185C1F60000-0x00000185C1F61000-memory.dmp

Filesize
4KB

Download
memory/1168-132-0x00000185C1F60000-0x00000185C1F61000-memory.dmp

Filesize
4KB

Download
memory/1168-135-0x00000185C1F60000-0x00000185C1F61000-memory.dmp

Filesize
4KB

Download
memory/1168-136-0x00000185C1F60000-0x00000185C1F61000-memory.dmp

Filesize
4KB

Download
memory/1168-133-0x00000185C1F60000-0x00000185C1F61000-memory.dmp

Filesize
4KB

Download
memory/1168-138-0x00000185C1F60000-0x00000185C1F61000-memory.dmp

Filesize
4KB

Download
memory/1168-139-0x00000185C1F60000-0x00000185C1F61000-memory.dmp

Filesize
4KB

Download
memory/1168-140-0x00000185C1B80000-0x00000185C1B81000-memory.dmp

Filesize
4KB

Download
memory/1168-141-0x00000185C1B70000-0x00000185C1B71000-memory.dmp

Filesize
4KB

Download
memory/1168-143-0x00000185C1B80000-0x00000185C1B81000-memory.dmp

Filesize
4KB

Download
memory/1168-146-0x00000185C1B70000-0x00000185C1B71000-memory.dmp

Filesize
4KB

Download
memory/1168-149-0x00000185C1AB0000-0x00000185C1AB1000-memory.dmp

Filesize
4KB

Download
memory/1168-161-0x00000185C1CB0000-0x00000185C1CB1000-memory.dmp

Filesize
4KB

Download
memory/1168-163-0x00000185C1CC0000-0x00000185C1CC1000-memory.dmp

Filesize
4KB

Download
memory/1168-164-0x00000185C1CC0000-0x00000185C1CC1000-memory.dmp

Filesize
4KB

Download
memory/1168-165-0x00000185C1DD0000-0x00000185C1DD1000-memory.dmp

Filesize
4KB

Download
memory/1168-97-0x00000185B9840000-0x00000185B9850000-memory.dmp

Filesize
64KB

Download
memory/1168-134-0x00000185C1F60000-0x00000185C1F61000-memory.dmp

Filesize
4KB

Download
memory/1168-131-0x00000185C1F60000-0x00000185C1F61000-memory.dmp

Filesize
4KB

Download
memory/1168-130-0x00000185C1F60000-0x00000185C1F61000-memory.dmp

Filesize
4KB

Download
memory/1168-129-0x00000185C1F30000-0x00000185C1F31000-memory.dmp

Filesize
4KB

Download
memory/1168-113-0x00000185B9940000-0x00000185B9950000-memory.dmp

Filesize
64KB

Download
memory/4448-186-0x000002BC23200000-0x000002BC23300000-memory.dmp

Filesize
1024KB

Download
memory/5168-60-0x00000296DDCE0000-0x00000296DDCE1000-memory.dmp

Filesize
4KB

Download
memory/5168-61-0x00000296DDCE0000-0x00000296DDCE1000-memory.dmp

Filesize
4KB

Download
memory/5168-62-0x00000296DDCE0000-0x00000296DDCE1000-memory.dmp

Filesize
4KB

Download
memory/5168-63-0x00000296DDCE0000-0x00000296DDCE1000-memory.dmp

Filesize
4KB

Download
memory/5168-64-0x00000296DDCE0000-0x00000296DDCE1000-memory.dmp

Filesize
4KB

Download
memory/5168-59-0x00000296DDCE0000-0x00000296DDCE1000-memory.dmp

Filesize
4KB

Download
memory/5168-58-0x00000296DDCE0000-0x00000296DDCE1000-memory.dmp

Filesize
4KB

Download
memory/5168-52-0x00000296DDCE0000-0x00000296DDCE1000-memory.dmp

Filesize
4KB

Download
memory/5168-53-0x00000296DDCE0000-0x00000296DDCE1000-memory.dmp

Filesize
4KB

Download
memory/5168-54-0x00000296DDCE0000-0x00000296DDCE1000-memory.dmp

Filesize
4KB

Download