Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
01-08-2022 22:16
Static task
static1
Behavioral task
behavioral1
Sample
74fb663087b66cbbc305c940bd1090e6.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
74fb663087b66cbbc305c940bd1090e6.exe
Resource
win10v2004-20220721-en
General
-
Target
74fb663087b66cbbc305c940bd1090e6.exe
-
Size
1.2MB
-
MD5
74fb663087b66cbbc305c940bd1090e6
-
SHA1
8fed8e979fd86ef3712ceb4d1a47d1bd670837e7
-
SHA256
01e1bbb9bb2c3e5ed68df65a2846faa611ec9bfcbf664e0abd5b72005502cac4
-
SHA512
1e7d224df8c2d07a9811bfa1548c7eb6fb5fd41f75ab4de888d410738ee77fa3673fc71afa31f4b094d2788154b6b5f1dfd8cb73bf510eb59068069a30b0a738
Malware Config
Extracted
redline
nam3
103.89.90.61:18728
-
auth_value
64b900120bbceaa6a9c60e9079492895
Extracted
redline
alex
185.106.92.128:16509
-
auth_value
4f79d5b8f5aae9e19c9693489b4872c0
Extracted
redline
4
31.41.244.134:11643
-
auth_value
a516b2d034ecd34338f12b50347fbd92
Extracted
redline
@tag12312341
62.204.41.144:14096
-
auth_value
71466795417275fac01979e57016e277
Extracted
raccoon
afb5c633c4650f69312baef49db9dfa4
http://77.73.132.84
Extracted
privateloader
http://163.123.143.4/proxies.txt
http://193.233.177.215/server.txt
pastebin.com/raw/A7dSG1te
http://wfsdragon.ru/api/setStats.php
163.123.143.12
Extracted
raccoon
f0c8034c83808635df0d9d8726d1bfd6
http://45.95.11.158/
Extracted
redline
185.215.113.46:8223
-
auth_value
1c36b510dbc8ee0265942899b008d972
Signatures
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Raccoon Stealer payload 6 IoCs
Processes:
resource yara_rule behavioral2/memory/5096-206-0x0000000000400000-0x00000000004B5000-memory.dmp family_raccoon behavioral2/memory/5096-205-0x00000000006D0000-0x00000000006E6000-memory.dmp family_raccoon behavioral2/memory/3080-233-0x00000000001E0000-0x00000000001EF000-memory.dmp family_raccoon behavioral2/memory/3080-241-0x0000000000400000-0x000000000062B000-memory.dmp family_raccoon behavioral2/memory/3080-277-0x00000000001E0000-0x00000000001EF000-memory.dmp family_raccoon behavioral2/memory/5096-309-0x0000000000400000-0x00000000004B5000-memory.dmp family_raccoon -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 15 IoCs
Processes:
resource yara_rule C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe family_redline C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe family_redline C:\Program Files (x86)\Company\NewProduct\Roman_12020.exe family_redline C:\Program Files (x86)\Company\NewProduct\Roman_12020.exe family_redline C:\Program Files (x86)\Company\NewProduct\safert44.exe family_redline C:\Program Files (x86)\Company\NewProduct\safert44.exe family_redline behavioral2/memory/1052-160-0x0000000000D90000-0x0000000000DD4000-memory.dmp family_redline behavioral2/memory/4352-161-0x0000000000CB0000-0x0000000000CD0000-memory.dmp family_redline C:\Program Files (x86)\Company\NewProduct\tag.exe family_redline C:\Program Files (x86)\Company\NewProduct\tag.exe family_redline behavioral2/memory/3952-170-0x0000000000030000-0x0000000000050000-memory.dmp family_redline behavioral2/memory/1324-159-0x0000000000010000-0x0000000000054000-memory.dmp family_redline C:\Program Files (x86)\Company\NewProduct\HappyRoot.exe family_redline C:\Program Files (x86)\Company\NewProduct\HappyRoot.exe family_redline behavioral2/memory/5748-255-0x00000000006C0000-0x00000000006E0000-memory.dmp family_redline -
Executes dropped EXE 10 IoCs
Processes:
namdoitntn.exereal.exeRoman_12020.exesafert44.exetag.exekukurzka9000.exeF0geI.exeg3rgg.exeEU1.exeHappyRoot.exepid process 1324 namdoitntn.exe 944 real.exe 4352 Roman_12020.exe 1052 safert44.exe 3952 tag.exe 5096 kukurzka9000.exe 3080 F0geI.exe 2236 g3rgg.exe 2888 EU1.exe 5748 HappyRoot.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
74fb663087b66cbbc305c940bd1090e6.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Control Panel\International\Geo\Nation 74fb663087b66cbbc305c940bd1090e6.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in Program Files directory 12 IoCs
Processes:
74fb663087b66cbbc305c940bd1090e6.exesetup.exedescription ioc process File opened for modification C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe 74fb663087b66cbbc305c940bd1090e6.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\real.exe 74fb663087b66cbbc305c940bd1090e6.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe 74fb663087b66cbbc305c940bd1090e6.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\F0geI.exe 74fb663087b66cbbc305c940bd1090e6.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\HappyRoot.exe 74fb663087b66cbbc305c940bd1090e6.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\EU1.exe 74fb663087b66cbbc305c940bd1090e6.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\Roman_12020.exe 74fb663087b66cbbc305c940bd1090e6.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\safert44.exe 74fb663087b66cbbc305c940bd1090e6.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\tag.exe 74fb663087b66cbbc305c940bd1090e6.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\g3rgg.exe 74fb663087b66cbbc305c940bd1090e6.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\2605944e-a804-4d8b-957a-08d7cd13a713.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20220802001700.pma setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4980 3080 WerFault.exe F0geI.exe 4024 2236 WerFault.exe g3rgg.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
real.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 real.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString real.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Modifies registry class 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 32 IoCs
Processes:
msedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exereal.exemsedge.exetag.exeRoman_12020.exenamdoitntn.exesafert44.exeidentity_helper.exeHappyRoot.exemsedge.exepid process 3044 msedge.exe 3968 msedge.exe 3044 msedge.exe 3968 msedge.exe 1596 msedge.exe 1596 msedge.exe 1016 msedge.exe 1016 msedge.exe 5264 msedge.exe 5264 msedge.exe 5284 msedge.exe 5284 msedge.exe 944 real.exe 944 real.exe 3720 msedge.exe 3720 msedge.exe 3952 tag.exe 3952 tag.exe 4352 Roman_12020.exe 4352 Roman_12020.exe 1324 namdoitntn.exe 1324 namdoitntn.exe 1052 safert44.exe 1052 safert44.exe 5072 identity_helper.exe 5072 identity_helper.exe 5748 HappyRoot.exe 5748 HappyRoot.exe 7132 msedge.exe 7132 msedge.exe 7132 msedge.exe 7132 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
Processes:
msedge.exepid process 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
tag.exeRoman_12020.exenamdoitntn.exesafert44.exeHappyRoot.exedescription pid process Token: SeDebugPrivilege 3952 tag.exe Token: SeDebugPrivilege 4352 Roman_12020.exe Token: SeDebugPrivilege 1324 namdoitntn.exe Token: SeDebugPrivilege 1052 safert44.exe Token: SeDebugPrivilege 5748 HappyRoot.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
msedge.exepid process 3720 msedge.exe 3720 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
74fb663087b66cbbc305c940bd1090e6.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exedescription pid process target process PID 4728 wrote to memory of 4568 4728 74fb663087b66cbbc305c940bd1090e6.exe msedge.exe PID 4728 wrote to memory of 4568 4728 74fb663087b66cbbc305c940bd1090e6.exe msedge.exe PID 4728 wrote to memory of 3224 4728 74fb663087b66cbbc305c940bd1090e6.exe msedge.exe PID 4728 wrote to memory of 3224 4728 74fb663087b66cbbc305c940bd1090e6.exe msedge.exe PID 3224 wrote to memory of 2648 3224 msedge.exe msedge.exe PID 3224 wrote to memory of 2648 3224 msedge.exe msedge.exe PID 4568 wrote to memory of 4692 4568 msedge.exe msedge.exe PID 4568 wrote to memory of 4692 4568 msedge.exe msedge.exe PID 4728 wrote to memory of 4176 4728 74fb663087b66cbbc305c940bd1090e6.exe msedge.exe PID 4728 wrote to memory of 4176 4728 74fb663087b66cbbc305c940bd1090e6.exe msedge.exe PID 4176 wrote to memory of 452 4176 msedge.exe msedge.exe PID 4176 wrote to memory of 452 4176 msedge.exe msedge.exe PID 4728 wrote to memory of 3720 4728 74fb663087b66cbbc305c940bd1090e6.exe msedge.exe PID 4728 wrote to memory of 3720 4728 74fb663087b66cbbc305c940bd1090e6.exe msedge.exe PID 3720 wrote to memory of 4140 3720 msedge.exe msedge.exe PID 3720 wrote to memory of 4140 3720 msedge.exe msedge.exe PID 4728 wrote to memory of 2224 4728 74fb663087b66cbbc305c940bd1090e6.exe msedge.exe PID 4728 wrote to memory of 2224 4728 74fb663087b66cbbc305c940bd1090e6.exe msedge.exe PID 2224 wrote to memory of 1280 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 1280 2224 msedge.exe msedge.exe PID 4728 wrote to memory of 4516 4728 74fb663087b66cbbc305c940bd1090e6.exe msedge.exe PID 4728 wrote to memory of 4516 4728 74fb663087b66cbbc305c940bd1090e6.exe msedge.exe PID 4516 wrote to memory of 3396 4516 msedge.exe msedge.exe PID 4516 wrote to memory of 3396 4516 msedge.exe msedge.exe PID 4728 wrote to memory of 1324 4728 74fb663087b66cbbc305c940bd1090e6.exe namdoitntn.exe PID 4728 wrote to memory of 1324 4728 74fb663087b66cbbc305c940bd1090e6.exe namdoitntn.exe PID 4728 wrote to memory of 1324 4728 74fb663087b66cbbc305c940bd1090e6.exe namdoitntn.exe PID 4728 wrote to memory of 944 4728 74fb663087b66cbbc305c940bd1090e6.exe real.exe PID 4728 wrote to memory of 944 4728 74fb663087b66cbbc305c940bd1090e6.exe real.exe PID 4728 wrote to memory of 944 4728 74fb663087b66cbbc305c940bd1090e6.exe real.exe PID 4728 wrote to memory of 4352 4728 74fb663087b66cbbc305c940bd1090e6.exe Roman_12020.exe PID 4728 wrote to memory of 4352 4728 74fb663087b66cbbc305c940bd1090e6.exe Roman_12020.exe PID 4728 wrote to memory of 4352 4728 74fb663087b66cbbc305c940bd1090e6.exe Roman_12020.exe PID 4728 wrote to memory of 1052 4728 74fb663087b66cbbc305c940bd1090e6.exe safert44.exe PID 4728 wrote to memory of 1052 4728 74fb663087b66cbbc305c940bd1090e6.exe safert44.exe PID 4728 wrote to memory of 1052 4728 74fb663087b66cbbc305c940bd1090e6.exe safert44.exe PID 4728 wrote to memory of 3952 4728 74fb663087b66cbbc305c940bd1090e6.exe tag.exe PID 4728 wrote to memory of 3952 4728 74fb663087b66cbbc305c940bd1090e6.exe tag.exe PID 4728 wrote to memory of 3952 4728 74fb663087b66cbbc305c940bd1090e6.exe tag.exe PID 4728 wrote to memory of 5096 4728 74fb663087b66cbbc305c940bd1090e6.exe kukurzka9000.exe PID 4728 wrote to memory of 5096 4728 74fb663087b66cbbc305c940bd1090e6.exe kukurzka9000.exe PID 4728 wrote to memory of 5096 4728 74fb663087b66cbbc305c940bd1090e6.exe kukurzka9000.exe PID 4728 wrote to memory of 3080 4728 74fb663087b66cbbc305c940bd1090e6.exe F0geI.exe PID 4728 wrote to memory of 3080 4728 74fb663087b66cbbc305c940bd1090e6.exe F0geI.exe PID 4728 wrote to memory of 3080 4728 74fb663087b66cbbc305c940bd1090e6.exe F0geI.exe PID 4728 wrote to memory of 2236 4728 74fb663087b66cbbc305c940bd1090e6.exe g3rgg.exe PID 4728 wrote to memory of 2236 4728 74fb663087b66cbbc305c940bd1090e6.exe g3rgg.exe PID 4728 wrote to memory of 2236 4728 74fb663087b66cbbc305c940bd1090e6.exe g3rgg.exe PID 4728 wrote to memory of 2888 4728 74fb663087b66cbbc305c940bd1090e6.exe EU1.exe PID 4728 wrote to memory of 2888 4728 74fb663087b66cbbc305c940bd1090e6.exe EU1.exe PID 4728 wrote to memory of 2888 4728 74fb663087b66cbbc305c940bd1090e6.exe EU1.exe PID 3720 wrote to memory of 4044 3720 msedge.exe msedge.exe PID 3720 wrote to memory of 4044 3720 msedge.exe msedge.exe PID 3720 wrote to memory of 4044 3720 msedge.exe msedge.exe PID 3720 wrote to memory of 4044 3720 msedge.exe msedge.exe PID 3720 wrote to memory of 4044 3720 msedge.exe msedge.exe PID 3720 wrote to memory of 4044 3720 msedge.exe msedge.exe PID 3720 wrote to memory of 4044 3720 msedge.exe msedge.exe PID 3720 wrote to memory of 4044 3720 msedge.exe msedge.exe PID 3720 wrote to memory of 4044 3720 msedge.exe msedge.exe PID 3720 wrote to memory of 4044 3720 msedge.exe msedge.exe PID 3720 wrote to memory of 4044 3720 msedge.exe msedge.exe PID 3720 wrote to memory of 4044 3720 msedge.exe msedge.exe PID 3720 wrote to memory of 4044 3720 msedge.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\74fb663087b66cbbc305c940bd1090e6.exe"C:\Users\Admin\AppData\Local\Temp\74fb663087b66cbbc305c940bd1090e6.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1RyjC42⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa8e6246f8,0x7ffa8e624708,0x7ffa8e6247183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,13621951361500504043,5935211337517416969,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,13621951361500504043,5935211337517416969,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2524 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1A4aK42⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa8e6246f8,0x7ffa8e624708,0x7ffa8e6247183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,746872067775628760,15688735249655964756,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,746872067775628760,15688735249655964756,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1RLtX42⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa8e6246f8,0x7ffa8e624708,0x7ffa8e6247183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,16787954187303140351,2066175525018109538,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,16787954187303140351,2066175525018109538,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1RCgX42⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa8e6246f8,0x7ffa8e624708,0x7ffa8e6247183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,3400148358629409923,3825739712842187764,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,3400148358629409923,3825739712842187764,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,3400148358629409923,3825739712842187764,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3400148358629409923,3825739712842187764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3400148358629409923,3825739712842187764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3580 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3400148358629409923,3825739712842187764,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3400148358629409923,3825739712842187764,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3400148358629409923,3825739712842187764,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3400148358629409923,3825739712842187764,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3400148358629409923,3825739712842187764,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3400148358629409923,3825739712842187764,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6168 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3400148358629409923,3825739712842187764,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6564 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2132,3400148358629409923,3825739712842187764,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6764 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3400148358629409923,3825739712842187764,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6252 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3400148358629409923,3825739712842187764,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6752 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2132,3400148358629409923,3825739712842187764,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6616 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings3⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff7305c5460,0x7ff7305c5470,0x7ff7305c54804⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,3400148358629409923,3825739712842187764,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8596 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,3400148358629409923,3825739712842187764,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8596 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2132,3400148358629409923,3825739712842187764,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3756 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,3400148358629409923,3825739712842187764,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3940 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2132,3400148358629409923,3825739712842187764,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4264 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1n7LH42⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa8e6246f8,0x7ffa8e624708,0x7ffa8e6247183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,12194423679784792166,8072069326034762838,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,12194423679784792166,8072069326034762838,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1nfDK42⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa8e6246f8,0x7ffa8e624708,0x7ffa8e6247183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,14413661865084304791,15332430959273872435,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,14413661865084304791,15332430959273872435,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe"C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Company\NewProduct\real.exe"C:\Program Files (x86)\Company\NewProduct\real.exe"2⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Company\NewProduct\Roman_12020.exe"C:\Program Files (x86)\Company\NewProduct\Roman_12020.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Company\NewProduct\safert44.exe"C:\Program Files (x86)\Company\NewProduct\safert44.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Company\NewProduct\tag.exe"C:\Program Files (x86)\Company\NewProduct\tag.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe"C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe"2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Company\NewProduct\F0geI.exe"C:\Program Files (x86)\Company\NewProduct\F0geI.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 5683⤵
- Program crash
-
C:\Program Files (x86)\Company\NewProduct\g3rgg.exe"C:\Program Files (x86)\Company\NewProduct\g3rgg.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 12643⤵
- Program crash
-
C:\Program Files (x86)\Company\NewProduct\EU1.exe"C:\Program Files (x86)\Company\NewProduct\EU1.exe"2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1nzwK42⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa8e6246f8,0x7ffa8e624708,0x7ffa8e6247183⤵
-
C:\Program Files (x86)\Company\NewProduct\HappyRoot.exe"C:\Program Files (x86)\Company\NewProduct\HappyRoot.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1Ay2Z42⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa8e6246f8,0x7ffa8e624708,0x7ffa8e6247183⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3080 -ip 30801⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2236 -ip 22361⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Company\NewProduct\EU1.exeFilesize
289KB
MD598ee616bbbdae32bd744f31d48e46c72
SHA1fb2fe19e8890c7c4be116db78254fe3e1beb08a0
SHA2565e0e8817946e234867eb10b92ce613a12d1597ca53e73020ec19e1c76b3566cb
SHA512fab7fc5c37551ca64daad4611b62d456ed245946298f1b813120ca0fe45ffb76c29ec8402327e58c565fdf42f2b1d0bd18864b4ab63f85742e2b99772981af9d
-
C:\Program Files (x86)\Company\NewProduct\EU1.exeFilesize
289KB
MD598ee616bbbdae32bd744f31d48e46c72
SHA1fb2fe19e8890c7c4be116db78254fe3e1beb08a0
SHA2565e0e8817946e234867eb10b92ce613a12d1597ca53e73020ec19e1c76b3566cb
SHA512fab7fc5c37551ca64daad4611b62d456ed245946298f1b813120ca0fe45ffb76c29ec8402327e58c565fdf42f2b1d0bd18864b4ab63f85742e2b99772981af9d
-
C:\Program Files (x86)\Company\NewProduct\F0geI.exeFilesize
178KB
MD58d24da259cd54db3ede2745724dbedab
SHA196f51cc49e1a6989dea96f382f2a958f488662a9
SHA25642f46c886e929d455bc3adbd693150d16f94aa48b050cfa463e399521c50e883
SHA512ec005a5ae8585088733fb692d78bbf2ff0f4f395c4b734e9d3bed66d6a73c2ee24c02da20351397768f2420c703ad47ffee785a2a2af455a000ab0e6620ec536
-
C:\Program Files (x86)\Company\NewProduct\F0geI.exeFilesize
178KB
MD58d24da259cd54db3ede2745724dbedab
SHA196f51cc49e1a6989dea96f382f2a958f488662a9
SHA25642f46c886e929d455bc3adbd693150d16f94aa48b050cfa463e399521c50e883
SHA512ec005a5ae8585088733fb692d78bbf2ff0f4f395c4b734e9d3bed66d6a73c2ee24c02da20351397768f2420c703ad47ffee785a2a2af455a000ab0e6620ec536
-
C:\Program Files (x86)\Company\NewProduct\HappyRoot.exeFilesize
107KB
MD50ad2faba47ab5f5933c240ece1ea7075
SHA16479bc7cedfc416856a700eda0d83bd5121b11f9
SHA25681cde4aac3ccad7227fa643504b0c7f26084951df6cb668671932079e13d923b
SHA51272011e4a5a0a90a79dcd2f8347afa2cf8dcd3f3feec2dbac8ab18941cd981f2f5aa730973d377f09f7b211b665be1974474d9e29ecabfba86cf12b3f188a3f32
-
C:\Program Files (x86)\Company\NewProduct\HappyRoot.exeFilesize
107KB
MD50ad2faba47ab5f5933c240ece1ea7075
SHA16479bc7cedfc416856a700eda0d83bd5121b11f9
SHA25681cde4aac3ccad7227fa643504b0c7f26084951df6cb668671932079e13d923b
SHA51272011e4a5a0a90a79dcd2f8347afa2cf8dcd3f3feec2dbac8ab18941cd981f2f5aa730973d377f09f7b211b665be1974474d9e29ecabfba86cf12b3f188a3f32
-
C:\Program Files (x86)\Company\NewProduct\Roman_12020.exeFilesize
107KB
MD5ba055c9213817647673b72f9ea898de9
SHA1e45a767b0fb77920d28198169f4e7d16809b9c9a
SHA256d2cb8ab16c0a8b29c99abab063775f3e0a115e5a4da9082064c7bc4a58cd6838
SHA5126fa57b1f0979aff2e746433c5c1ba3a7d8543c7938837b874b3c73f0520550d02f751c4c46b8c460e9672062d9b5c4e4d8a31d72fd2e448533986da2da7aacb9
-
C:\Program Files (x86)\Company\NewProduct\Roman_12020.exeFilesize
107KB
MD5ba055c9213817647673b72f9ea898de9
SHA1e45a767b0fb77920d28198169f4e7d16809b9c9a
SHA256d2cb8ab16c0a8b29c99abab063775f3e0a115e5a4da9082064c7bc4a58cd6838
SHA5126fa57b1f0979aff2e746433c5c1ba3a7d8543c7938837b874b3c73f0520550d02f751c4c46b8c460e9672062d9b5c4e4d8a31d72fd2e448533986da2da7aacb9
-
C:\Program Files (x86)\Company\NewProduct\g3rgg.exeFilesize
386KB
MD559be2ebcf6516dd07ee5df8eae402523
SHA1e4e5b949a0c9721e4c89f124750d8a97e4d96c7e
SHA256d2952be5c81f4135c0953b7b36677704f24f4d780de268ce6b67a44a6f15419a
SHA5129148e9a303a3562f9552da8fa6cdd3c1d4034be31d20968a8dc51904c0d4cf167c0cdfa0d6ceac0ec0a24a975b8c04de9a1d4d67f0056dce810ad4e5b83215d2
-
C:\Program Files (x86)\Company\NewProduct\g3rgg.exeFilesize
386KB
MD559be2ebcf6516dd07ee5df8eae402523
SHA1e4e5b949a0c9721e4c89f124750d8a97e4d96c7e
SHA256d2952be5c81f4135c0953b7b36677704f24f4d780de268ce6b67a44a6f15419a
SHA5129148e9a303a3562f9552da8fa6cdd3c1d4034be31d20968a8dc51904c0d4cf167c0cdfa0d6ceac0ec0a24a975b8c04de9a1d4d67f0056dce810ad4e5b83215d2
-
C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exeFilesize
699KB
MD5591fe3c4a7613d32309af09848c88233
SHA18170fce4ede2b4769fad1bec999db5d6a138fbb1
SHA2569f289f95453c588a9ff4bef57b59d6ec812e985b14fdae4554b7112e52819e9d
SHA512e1b3c7c3a807814a7a8139e7043053d12820bdd18c6e4d1320818f9f8b0e1c98a0786425c2d68ad7f789160f816eaa367402af5c67f2e204b9ec0831c1a04f6c
-
C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exeFilesize
699KB
MD5591fe3c4a7613d32309af09848c88233
SHA18170fce4ede2b4769fad1bec999db5d6a138fbb1
SHA2569f289f95453c588a9ff4bef57b59d6ec812e985b14fdae4554b7112e52819e9d
SHA512e1b3c7c3a807814a7a8139e7043053d12820bdd18c6e4d1320818f9f8b0e1c98a0786425c2d68ad7f789160f816eaa367402af5c67f2e204b9ec0831c1a04f6c
-
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exeFilesize
245KB
MD5b16134159e66a72fb36d93bc703b4188
SHA1e869e91a2b0f77e7ac817e0b30a9a23d537b3001
SHA256b064af166491cb307cfcb9ce53c09696d9d3f6bfa65dfc60b237c275be9b655c
SHA5123fdf205ca16de89c7ed382ed42f628e1211f3e5aff5bf7dedc47927f3dd7ff54b0dd10b4e8282b9693f45a5ee7a26234f899d14bfd8eb0fd078b42a4ed8b8b4c
-
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exeFilesize
245KB
MD5b16134159e66a72fb36d93bc703b4188
SHA1e869e91a2b0f77e7ac817e0b30a9a23d537b3001
SHA256b064af166491cb307cfcb9ce53c09696d9d3f6bfa65dfc60b237c275be9b655c
SHA5123fdf205ca16de89c7ed382ed42f628e1211f3e5aff5bf7dedc47927f3dd7ff54b0dd10b4e8282b9693f45a5ee7a26234f899d14bfd8eb0fd078b42a4ed8b8b4c
-
C:\Program Files (x86)\Company\NewProduct\real.exeFilesize
289KB
MD584d016c5a9e810c2ef08767805a87589
SHA1750b15c9c1acdfcd1396ecec11ab109706a945ad
SHA2566e8bae93bead10d8778a8f442828aac20a0bd5c87cabe3f6d76282a9d47b7845
SHA5127c612dd0f3eab6cb602c12390f62daa0e75d83433bcd4b682d1d5b931ebc52c8f6b32acd12474bdf6eecb91541dfa11cbbd57ca6cf8297ae9c407923e4d95953
-
C:\Program Files (x86)\Company\NewProduct\real.exeFilesize
289KB
MD584d016c5a9e810c2ef08767805a87589
SHA1750b15c9c1acdfcd1396ecec11ab109706a945ad
SHA2566e8bae93bead10d8778a8f442828aac20a0bd5c87cabe3f6d76282a9d47b7845
SHA5127c612dd0f3eab6cb602c12390f62daa0e75d83433bcd4b682d1d5b931ebc52c8f6b32acd12474bdf6eecb91541dfa11cbbd57ca6cf8297ae9c407923e4d95953
-
C:\Program Files (x86)\Company\NewProduct\safert44.exeFilesize
244KB
MD5dbe947674ea388b565ae135a09cc6638
SHA1ae8e1c69bd1035a92b7e06baad5e387de3a70572
SHA25686aeac2a4ee8e62265ee570718bbd41a4e643e0bad69e7b4fa6c24baeb220709
SHA51267441aebbf7ce4d53fbb665124f309faed7842b3e424e018454ff6d6f790219633ce6a9b370aeaf77c5092e84f4391df13e964ca6a28597810dee41c3c833893
-
C:\Program Files (x86)\Company\NewProduct\safert44.exeFilesize
244KB
MD5dbe947674ea388b565ae135a09cc6638
SHA1ae8e1c69bd1035a92b7e06baad5e387de3a70572
SHA25686aeac2a4ee8e62265ee570718bbd41a4e643e0bad69e7b4fa6c24baeb220709
SHA51267441aebbf7ce4d53fbb665124f309faed7842b3e424e018454ff6d6f790219633ce6a9b370aeaf77c5092e84f4391df13e964ca6a28597810dee41c3c833893
-
C:\Program Files (x86)\Company\NewProduct\tag.exeFilesize
107KB
MD52ebc22860c7d9d308c018f0ffb5116ff
SHA178791a83f7161e58f9b7df45f9be618e9daea4cd
SHA2568e2c9fd68fc850fa610d1edfd46fc4a66adbef24e42a1841290b0e0c08597e89
SHA512d4842627f6fab09f9472ed0b09b5e012524bf6b821d90a753275f68de65b7ba084a9e15daca58a183f89b166cc9d2d2f2d6a81e1110e66c5822b548279c8c05e
-
C:\Program Files (x86)\Company\NewProduct\tag.exeFilesize
107KB
MD52ebc22860c7d9d308c018f0ffb5116ff
SHA178791a83f7161e58f9b7df45f9be618e9daea4cd
SHA2568e2c9fd68fc850fa610d1edfd46fc4a66adbef24e42a1841290b0e0c08597e89
SHA512d4842627f6fab09f9472ed0b09b5e012524bf6b821d90a753275f68de65b7ba084a9e15daca58a183f89b166cc9d2d2f2d6a81e1110e66c5822b548279c8c05e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53Filesize
471B
MD530c3f5945fa2efbbfa7f60fd0bf17366
SHA1fb7d52747327de5f4ca4e473b10956411f03e0fc
SHA2564dc42d0c7c1c309738c4d536cc248479aefaa96cfb87812c2c026bb2309f222c
SHA512ecb4f91cd41a628ef6c02e9d10605b0d7cd73e0ec85db8e37b240e341ed4caf03deb2e76f283abaffa34ea8fef3bba0cae035d7a1c20226db11f01c81c303199
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53Filesize
471B
MD530c3f5945fa2efbbfa7f60fd0bf17366
SHA1fb7d52747327de5f4ca4e473b10956411f03e0fc
SHA2564dc42d0c7c1c309738c4d536cc248479aefaa96cfb87812c2c026bb2309f222c
SHA512ecb4f91cd41a628ef6c02e9d10605b0d7cd73e0ec85db8e37b240e341ed4caf03deb2e76f283abaffa34ea8fef3bba0cae035d7a1c20226db11f01c81c303199
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53Filesize
412B
MD52e8e9f11d87600a09bc9f7d61999fcff
SHA1e1e898077081fe874a309d7d8e80132c6b8e2713
SHA25697a14b6fe75ba554cc533b82957123a94daab6fc9ef984f4f249bc8214d91818
SHA512885afe5170071214548c14c22e560f72509c1cd336c7f1de7077fa1de9c32e73e9b680f13dc05f2a58d09ebccb92b5f0e158cd9f08d44816360fb92aecd93a5f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53Filesize
412B
MD52e8e9f11d87600a09bc9f7d61999fcff
SHA1e1e898077081fe874a309d7d8e80132c6b8e2713
SHA25697a14b6fe75ba554cc533b82957123a94daab6fc9ef984f4f249bc8214d91818
SHA512885afe5170071214548c14c22e560f72509c1cd336c7f1de7077fa1de9c32e73e9b680f13dc05f2a58d09ebccb92b5f0e158cd9f08d44816360fb92aecd93a5f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53Filesize
412B
MD52e8e9f11d87600a09bc9f7d61999fcff
SHA1e1e898077081fe874a309d7d8e80132c6b8e2713
SHA25697a14b6fe75ba554cc533b82957123a94daab6fc9ef984f4f249bc8214d91818
SHA512885afe5170071214548c14c22e560f72509c1cd336c7f1de7077fa1de9c32e73e9b680f13dc05f2a58d09ebccb92b5f0e158cd9f08d44816360fb92aecd93a5f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD539d33ed8e39d48cbbe10137b840a938a
SHA1af463ffd0fe9508fb7c71585709eaada860626bc
SHA256d2dd2e1482b5a8808b7a88a8979fa6ad2ded1a99a0b6c83ddcc3004261d01451
SHA51218c96d2add074aaa3dd470ba01f104be0f107d51417bc8c8a609f69a444e598049b3fbe4d2a84f29b7e59e0aa5de474655735418d2838e8efe20aa675b96f6bc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD539d33ed8e39d48cbbe10137b840a938a
SHA1af463ffd0fe9508fb7c71585709eaada860626bc
SHA256d2dd2e1482b5a8808b7a88a8979fa6ad2ded1a99a0b6c83ddcc3004261d01451
SHA51218c96d2add074aaa3dd470ba01f104be0f107d51417bc8c8a609f69a444e598049b3fbe4d2a84f29b7e59e0aa5de474655735418d2838e8efe20aa675b96f6bc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD539d33ed8e39d48cbbe10137b840a938a
SHA1af463ffd0fe9508fb7c71585709eaada860626bc
SHA256d2dd2e1482b5a8808b7a88a8979fa6ad2ded1a99a0b6c83ddcc3004261d01451
SHA51218c96d2add074aaa3dd470ba01f104be0f107d51417bc8c8a609f69a444e598049b3fbe4d2a84f29b7e59e0aa5de474655735418d2838e8efe20aa675b96f6bc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD539d33ed8e39d48cbbe10137b840a938a
SHA1af463ffd0fe9508fb7c71585709eaada860626bc
SHA256d2dd2e1482b5a8808b7a88a8979fa6ad2ded1a99a0b6c83ddcc3004261d01451
SHA51218c96d2add074aaa3dd470ba01f104be0f107d51417bc8c8a609f69a444e598049b3fbe4d2a84f29b7e59e0aa5de474655735418d2838e8efe20aa675b96f6bc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD539d33ed8e39d48cbbe10137b840a938a
SHA1af463ffd0fe9508fb7c71585709eaada860626bc
SHA256d2dd2e1482b5a8808b7a88a8979fa6ad2ded1a99a0b6c83ddcc3004261d01451
SHA51218c96d2add074aaa3dd470ba01f104be0f107d51417bc8c8a609f69a444e598049b3fbe4d2a84f29b7e59e0aa5de474655735418d2838e8efe20aa675b96f6bc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD539d33ed8e39d48cbbe10137b840a938a
SHA1af463ffd0fe9508fb7c71585709eaada860626bc
SHA256d2dd2e1482b5a8808b7a88a8979fa6ad2ded1a99a0b6c83ddcc3004261d01451
SHA51218c96d2add074aaa3dd470ba01f104be0f107d51417bc8c8a609f69a444e598049b3fbe4d2a84f29b7e59e0aa5de474655735418d2838e8efe20aa675b96f6bc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD539d33ed8e39d48cbbe10137b840a938a
SHA1af463ffd0fe9508fb7c71585709eaada860626bc
SHA256d2dd2e1482b5a8808b7a88a8979fa6ad2ded1a99a0b6c83ddcc3004261d01451
SHA51218c96d2add074aaa3dd470ba01f104be0f107d51417bc8c8a609f69a444e598049b3fbe4d2a84f29b7e59e0aa5de474655735418d2838e8efe20aa675b96f6bc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD539d33ed8e39d48cbbe10137b840a938a
SHA1af463ffd0fe9508fb7c71585709eaada860626bc
SHA256d2dd2e1482b5a8808b7a88a8979fa6ad2ded1a99a0b6c83ddcc3004261d01451
SHA51218c96d2add074aaa3dd470ba01f104be0f107d51417bc8c8a609f69a444e598049b3fbe4d2a84f29b7e59e0aa5de474655735418d2838e8efe20aa675b96f6bc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD539d33ed8e39d48cbbe10137b840a938a
SHA1af463ffd0fe9508fb7c71585709eaada860626bc
SHA256d2dd2e1482b5a8808b7a88a8979fa6ad2ded1a99a0b6c83ddcc3004261d01451
SHA51218c96d2add074aaa3dd470ba01f104be0f107d51417bc8c8a609f69a444e598049b3fbe4d2a84f29b7e59e0aa5de474655735418d2838e8efe20aa675b96f6bc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD539d33ed8e39d48cbbe10137b840a938a
SHA1af463ffd0fe9508fb7c71585709eaada860626bc
SHA256d2dd2e1482b5a8808b7a88a8979fa6ad2ded1a99a0b6c83ddcc3004261d01451
SHA51218c96d2add074aaa3dd470ba01f104be0f107d51417bc8c8a609f69a444e598049b3fbe4d2a84f29b7e59e0aa5de474655735418d2838e8efe20aa675b96f6bc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD539d33ed8e39d48cbbe10137b840a938a
SHA1af463ffd0fe9508fb7c71585709eaada860626bc
SHA256d2dd2e1482b5a8808b7a88a8979fa6ad2ded1a99a0b6c83ddcc3004261d01451
SHA51218c96d2add074aaa3dd470ba01f104be0f107d51417bc8c8a609f69a444e598049b3fbe4d2a84f29b7e59e0aa5de474655735418d2838e8efe20aa675b96f6bc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5c4f48398fdb31b8bd84eadac9ddf5acc
SHA156bc7ec79f71a6f609e12c1c8ca68c9a83c352e5
SHA2568acec190b9fa36a48e95fa130737ceb06cb498c771ff6874ebc47da5825d1746
SHA51216b756eae47dae99f48803625c7a0c30e306a76c27578c829cccf32c9cb52df0aea32bc92d07c7b18fe249cf4fa443e2365d07f0bec4bf47f97af762b7ab3b94
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5c4f48398fdb31b8bd84eadac9ddf5acc
SHA156bc7ec79f71a6f609e12c1c8ca68c9a83c352e5
SHA2568acec190b9fa36a48e95fa130737ceb06cb498c771ff6874ebc47da5825d1746
SHA51216b756eae47dae99f48803625c7a0c30e306a76c27578c829cccf32c9cb52df0aea32bc92d07c7b18fe249cf4fa443e2365d07f0bec4bf47f97af762b7ab3b94
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5c4f48398fdb31b8bd84eadac9ddf5acc
SHA156bc7ec79f71a6f609e12c1c8ca68c9a83c352e5
SHA2568acec190b9fa36a48e95fa130737ceb06cb498c771ff6874ebc47da5825d1746
SHA51216b756eae47dae99f48803625c7a0c30e306a76c27578c829cccf32c9cb52df0aea32bc92d07c7b18fe249cf4fa443e2365d07f0bec4bf47f97af762b7ab3b94
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5c4f48398fdb31b8bd84eadac9ddf5acc
SHA156bc7ec79f71a6f609e12c1c8ca68c9a83c352e5
SHA2568acec190b9fa36a48e95fa130737ceb06cb498c771ff6874ebc47da5825d1746
SHA51216b756eae47dae99f48803625c7a0c30e306a76c27578c829cccf32c9cb52df0aea32bc92d07c7b18fe249cf4fa443e2365d07f0bec4bf47f97af762b7ab3b94
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5c4f48398fdb31b8bd84eadac9ddf5acc
SHA156bc7ec79f71a6f609e12c1c8ca68c9a83c352e5
SHA2568acec190b9fa36a48e95fa130737ceb06cb498c771ff6874ebc47da5825d1746
SHA51216b756eae47dae99f48803625c7a0c30e306a76c27578c829cccf32c9cb52df0aea32bc92d07c7b18fe249cf4fa443e2365d07f0bec4bf47f97af762b7ab3b94
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5c4f48398fdb31b8bd84eadac9ddf5acc
SHA156bc7ec79f71a6f609e12c1c8ca68c9a83c352e5
SHA2568acec190b9fa36a48e95fa130737ceb06cb498c771ff6874ebc47da5825d1746
SHA51216b756eae47dae99f48803625c7a0c30e306a76c27578c829cccf32c9cb52df0aea32bc92d07c7b18fe249cf4fa443e2365d07f0bec4bf47f97af762b7ab3b94
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5c4f48398fdb31b8bd84eadac9ddf5acc
SHA156bc7ec79f71a6f609e12c1c8ca68c9a83c352e5
SHA2568acec190b9fa36a48e95fa130737ceb06cb498c771ff6874ebc47da5825d1746
SHA51216b756eae47dae99f48803625c7a0c30e306a76c27578c829cccf32c9cb52df0aea32bc92d07c7b18fe249cf4fa443e2365d07f0bec4bf47f97af762b7ab3b94
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5c4f48398fdb31b8bd84eadac9ddf5acc
SHA156bc7ec79f71a6f609e12c1c8ca68c9a83c352e5
SHA2568acec190b9fa36a48e95fa130737ceb06cb498c771ff6874ebc47da5825d1746
SHA51216b756eae47dae99f48803625c7a0c30e306a76c27578c829cccf32c9cb52df0aea32bc92d07c7b18fe249cf4fa443e2365d07f0bec4bf47f97af762b7ab3b94
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5c4f48398fdb31b8bd84eadac9ddf5acc
SHA156bc7ec79f71a6f609e12c1c8ca68c9a83c352e5
SHA2568acec190b9fa36a48e95fa130737ceb06cb498c771ff6874ebc47da5825d1746
SHA51216b756eae47dae99f48803625c7a0c30e306a76c27578c829cccf32c9cb52df0aea32bc92d07c7b18fe249cf4fa443e2365d07f0bec4bf47f97af762b7ab3b94
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD519c29ae74523f4eb291f21bdf5383c88
SHA149a58f9e80a5b58fd10233a9bc3afaa09bcd5a95
SHA25637110159e2e43ab999dbdeb9dc41868069773e9c1b9d967ae66c71cebb6c9aea
SHA512604f81cea3c70c95aab9ed3c2d3b7203d3a86e7d88e51d3c6ca2fb967bc5b069960ac3149128cf2d738e317e60b1792f43a084b637438b706e4ae3482c710abc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD5714a9af29e3e14da1cf3db22f0a5f921
SHA1c552ccd85035d414aced0c61d785f854da766795
SHA256b3f19e2d4b01f4fec4dc08e814e1e62989466e3bddcea1d966db47c1a766c937
SHA512032c887c31dea8f0dd7f93aa77f657a59fd8a473ea6d79949e2632cf5483d3e0d8c8d56962f6d75a510917126201f29a3aaff2426774e89150b45ec1ca6fff28
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD51c6f750750568d58be98ac24f5016b0b
SHA1a240e14519e3380de30c3ef1882ea22fba1f5fde
SHA256d124f307b1a8dcd0e9c45f99b7c54900da720144201696a170d852e2c94748ec
SHA512bde787cfdbeacb4fd0baa68be2d0177554fe434d4b132d61aaeadcfac4b3c7ec6cd49b2a6d2fe53617b0b9ac5fd7fa5eb5f26a37d90a2013e00b38d1def0880c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD51c6f750750568d58be98ac24f5016b0b
SHA1a240e14519e3380de30c3ef1882ea22fba1f5fde
SHA256d124f307b1a8dcd0e9c45f99b7c54900da720144201696a170d852e2c94748ec
SHA512bde787cfdbeacb4fd0baa68be2d0177554fe434d4b132d61aaeadcfac4b3c7ec6cd49b2a6d2fe53617b0b9ac5fd7fa5eb5f26a37d90a2013e00b38d1def0880c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD52ce33e3d4962e39f28e90ab70e6fc245
SHA193bafe4c4844e9e004b8ae896d6d836ec650a3a3
SHA256f2214cb77f15c4e8fddff35526e0223ddfbbd372c8c4d97b2bb4566a5a50dde9
SHA512e78dc55c17689dec1f2bed3ad49fa07d7d6f9b8b1afbb74dfb11f0cfbb8ecdcbae16ac38283b73e18f5f3ff37646dc21e4c69a9a5ed85bfe26a66711e57b6e53
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD5714a9af29e3e14da1cf3db22f0a5f921
SHA1c552ccd85035d414aced0c61d785f854da766795
SHA256b3f19e2d4b01f4fec4dc08e814e1e62989466e3bddcea1d966db47c1a766c937
SHA512032c887c31dea8f0dd7f93aa77f657a59fd8a473ea6d79949e2632cf5483d3e0d8c8d56962f6d75a510917126201f29a3aaff2426774e89150b45ec1ca6fff28
-
\??\pipe\LOCAL\crashpad_2224_IAKAKBUYFDAIDKMDMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\LOCAL\crashpad_3720_YHPFELFKIWUDSOJPMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\LOCAL\crashpad_4176_YOPMOBTNTGQVMRDJMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\LOCAL\crashpad_4516_RAIBYCCIWMKENDJEMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\LOCAL\crashpad_4568_TTPALIMEOJJZVAYVMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/452-135-0x0000000000000000-mapping.dmp
-
memory/944-150-0x0000000000000000-mapping.dmp
-
memory/944-210-0x0000000060900000-0x0000000060992000-memory.dmpFilesize
584KB
-
memory/1016-198-0x0000000000000000-mapping.dmp
-
memory/1052-160-0x0000000000D90000-0x0000000000DD4000-memory.dmpFilesize
272KB
-
memory/1052-184-0x00000000058D0000-0x00000000059DA000-memory.dmpFilesize
1.0MB
-
memory/1052-156-0x0000000000000000-mapping.dmp
-
memory/1080-316-0x0000000000000000-mapping.dmp
-
memory/1176-195-0x0000000000000000-mapping.dmp
-
memory/1280-142-0x0000000000000000-mapping.dmp
-
memory/1324-159-0x0000000000010000-0x0000000000054000-memory.dmpFilesize
272KB
-
memory/1324-147-0x0000000000000000-mapping.dmp
-
memory/1596-196-0x0000000000000000-mapping.dmp
-
memory/2044-201-0x0000000000000000-mapping.dmp
-
memory/2160-304-0x0000000000000000-mapping.dmp
-
memory/2224-141-0x0000000000000000-mapping.dmp
-
memory/2236-207-0x0000000000598000-0x00000000005BE000-memory.dmpFilesize
152KB
-
memory/2236-303-0x0000000000400000-0x000000000046C000-memory.dmpFilesize
432KB
-
memory/2236-310-0x0000000000598000-0x00000000005BE000-memory.dmpFilesize
152KB
-
memory/2236-252-0x0000000000400000-0x000000000046C000-memory.dmpFilesize
432KB
-
memory/2236-178-0x0000000000000000-mapping.dmp
-
memory/2236-311-0x0000000000400000-0x000000000046C000-memory.dmpFilesize
432KB
-
memory/2236-234-0x0000000000520000-0x0000000000579000-memory.dmpFilesize
356KB
-
memory/2236-278-0x0000000000520000-0x0000000000579000-memory.dmpFilesize
356KB
-
memory/2648-132-0x0000000000000000-mapping.dmp
-
memory/2888-181-0x0000000000000000-mapping.dmp
-
memory/3044-209-0x0000000000000000-mapping.dmp
-
memory/3080-208-0x0000000000943000-0x0000000000954000-memory.dmpFilesize
68KB
-
memory/3080-288-0x0000000000943000-0x0000000000954000-memory.dmpFilesize
68KB
-
memory/3080-241-0x0000000000400000-0x000000000062B000-memory.dmpFilesize
2.2MB
-
memory/3080-277-0x00000000001E0000-0x00000000001EF000-memory.dmpFilesize
60KB
-
memory/3080-233-0x00000000001E0000-0x00000000001EF000-memory.dmpFilesize
60KB
-
memory/3080-175-0x0000000000000000-mapping.dmp
-
memory/3224-131-0x0000000000000000-mapping.dmp
-
memory/3396-145-0x0000000000000000-mapping.dmp
-
memory/3720-138-0x0000000000000000-mapping.dmp
-
memory/3892-202-0x0000000000000000-mapping.dmp
-
memory/3952-308-0x0000000006DD0000-0x00000000072FC000-memory.dmpFilesize
5.2MB
-
memory/3952-170-0x0000000000030000-0x0000000000050000-memory.dmpFilesize
128KB
-
memory/3952-162-0x0000000000000000-mapping.dmp
-
memory/3952-183-0x0000000004880000-0x0000000004892000-memory.dmpFilesize
72KB
-
memory/3968-204-0x0000000000000000-mapping.dmp
-
memory/4020-235-0x0000000000000000-mapping.dmp
-
memory/4044-193-0x0000000000000000-mapping.dmp
-
memory/4140-139-0x0000000000000000-mapping.dmp
-
memory/4176-134-0x0000000000000000-mapping.dmp
-
memory/4300-313-0x0000000000000000-mapping.dmp
-
memory/4352-298-0x0000000006280000-0x0000000006312000-memory.dmpFilesize
584KB
-
memory/4352-190-0x0000000005560000-0x000000000559C000-memory.dmpFilesize
240KB
-
memory/4352-307-0x0000000007320000-0x00000000074E2000-memory.dmpFilesize
1.8MB
-
memory/4352-302-0x0000000006FB0000-0x0000000007000000-memory.dmpFilesize
320KB
-
memory/4352-299-0x0000000006320000-0x0000000006386000-memory.dmpFilesize
408KB
-
memory/4352-297-0x0000000006730000-0x0000000006CD4000-memory.dmpFilesize
5.6MB
-
memory/4352-182-0x0000000005A60000-0x0000000006078000-memory.dmpFilesize
6.1MB
-
memory/4352-153-0x0000000000000000-mapping.dmp
-
memory/4352-161-0x0000000000CB0000-0x0000000000CD0000-memory.dmpFilesize
128KB
-
memory/4484-305-0x0000000000000000-mapping.dmp
-
memory/4516-143-0x0000000000000000-mapping.dmp
-
memory/4548-262-0x0000000000000000-mapping.dmp
-
memory/4568-130-0x0000000000000000-mapping.dmp
-
memory/4660-294-0x0000000000000000-mapping.dmp
-
memory/4692-133-0x0000000000000000-mapping.dmp
-
memory/4888-203-0x0000000000000000-mapping.dmp
-
memory/4900-292-0x0000000000000000-mapping.dmp
-
memory/5024-232-0x0000000000000000-mapping.dmp
-
memory/5072-306-0x0000000000000000-mapping.dmp
-
memory/5096-309-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/5096-172-0x0000000000000000-mapping.dmp
-
memory/5096-206-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/5096-205-0x00000000006D0000-0x00000000006E6000-memory.dmpFilesize
88KB
-
memory/5128-240-0x0000000000000000-mapping.dmp
-
memory/5160-239-0x0000000000000000-mapping.dmp
-
memory/5264-243-0x0000000000000000-mapping.dmp
-
memory/5284-244-0x0000000000000000-mapping.dmp
-
memory/5292-260-0x0000000000000000-mapping.dmp
-
memory/5316-265-0x0000000000000000-mapping.dmp
-
memory/5748-250-0x0000000000000000-mapping.dmp
-
memory/5748-300-0x00000000052B0000-0x0000000005326000-memory.dmpFilesize
472KB
-
memory/5748-301-0x0000000005BB0000-0x0000000005BCE000-memory.dmpFilesize
120KB
-
memory/5748-255-0x00000000006C0000-0x00000000006E0000-memory.dmpFilesize
128KB
-
memory/6156-266-0x0000000000000000-mapping.dmp
-
memory/6224-268-0x0000000000000000-mapping.dmp
-
memory/6344-269-0x0000000000000000-mapping.dmp
-
memory/6428-296-0x0000000000000000-mapping.dmp
-
memory/6440-276-0x0000000000000000-mapping.dmp
-
memory/6576-280-0x0000000000000000-mapping.dmp
-
memory/6612-283-0x0000000000000000-mapping.dmp
-
memory/6684-285-0x0000000000000000-mapping.dmp
-
memory/6832-287-0x0000000000000000-mapping.dmp
-
memory/6916-290-0x0000000000000000-mapping.dmp
-
memory/7132-314-0x0000000000000000-mapping.dmp