Analysis
-
max time kernel
157s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
02-08-2022 14:11
Static task
static1
Behavioral task
behavioral1
Sample
a3b0afc1b50c24f3760768789e6826ad.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
a3b0afc1b50c24f3760768789e6826ad.exe
Resource
win10v2004-20220721-en
General
-
Target
a3b0afc1b50c24f3760768789e6826ad.exe
-
Size
936KB
-
MD5
a3b0afc1b50c24f3760768789e6826ad
-
SHA1
e0efd1f147379c712553657e4ee07a4d62c8889f
-
SHA256
b91e7fd40c84298ad53bae03f61d45d9e8ea323c6fecded7a4b98f53ebf36110
-
SHA512
2d235b1d8b3f81a574218ed73e163a874b57dccb632e5828de1864c15e7d12ee2224813d74272bd2d6ea4698bf09becda987d09d060f5641a7783014e7a07f85
Malware Config
Extracted
redline
nam3
103.89.90.61:18728
-
auth_value
64b900120bbceaa6a9c60e9079492895
Extracted
redline
4
31.41.244.134:11643
-
auth_value
a516b2d034ecd34338f12b50347fbd92
Extracted
redline
@tag12312341
62.204.41.144:14096
-
auth_value
71466795417275fac01979e57016e277
Extracted
raccoon
afb5c633c4650f69312baef49db9dfa4
http://77.73.132.84
Extracted
redline
185.215.113.46:8223
-
auth_value
1c36b510dbc8ee0265942899b008d972
Extracted
redline
5076357887
195.54.170.157:16525
-
auth_value
0dfaff60271d374d0c206d19883e06f3
Extracted
redline
RuXa_RR88
insttaller.com:37143
-
auth_value
0d650b837937aa916d555af4efd041b0
Extracted
raccoon
f0c8034c83808635df0d9d8726d1bfd6
http://45.95.11.158/
Signatures
-
Raccoon Stealer payload 6 IoCs
Processes:
resource yara_rule behavioral2/memory/332-181-0x0000000000400000-0x00000000004B5000-memory.dmp family_raccoon behavioral2/memory/332-180-0x00000000005F0000-0x0000000000606000-memory.dmp family_raccoon behavioral2/memory/1108-257-0x00000000001E0000-0x00000000001EF000-memory.dmp family_raccoon behavioral2/memory/1108-261-0x0000000000400000-0x000000000062B000-memory.dmp family_raccoon behavioral2/memory/332-288-0x0000000000400000-0x00000000004B5000-memory.dmp family_raccoon behavioral2/memory/1108-295-0x0000000000400000-0x000000000062B000-memory.dmp family_raccoon -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
Processes:
resource yara_rule C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe family_redline C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe family_redline C:\Program Files (x86)\Company\NewProduct\safert44.exe family_redline C:\Program Files (x86)\Company\NewProduct\tag.exe family_redline C:\Program Files (x86)\Company\NewProduct\safert44.exe family_redline C:\Program Files (x86)\Company\NewProduct\tag.exe family_redline behavioral2/memory/3840-162-0x0000000000800000-0x0000000000844000-memory.dmp family_redline behavioral2/memory/224-164-0x0000000000040000-0x0000000000084000-memory.dmp family_redline behavioral2/memory/4532-163-0x0000000000060000-0x0000000000080000-memory.dmp family_redline C:\Program Files (x86)\Company\NewProduct\HappyRoot.exe family_redline C:\Program Files (x86)\Company\NewProduct\HappyRoot.exe family_redline behavioral2/memory/924-186-0x0000000000320000-0x0000000000340000-memory.dmp family_redline C:\Program Files (x86)\Company\NewProduct\jshainx.exe family_redline C:\Program Files (x86)\Company\NewProduct\jshainx.exe family_redline behavioral2/memory/2304-202-0x00000000002A0000-0x00000000002C0000-memory.dmp family_redline C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe family_redline C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe family_redline behavioral2/memory/4372-239-0x0000000000DC0000-0x0000000000DE0000-memory.dmp family_redline -
Downloads MZ/PE file
-
Executes dropped EXE 11 IoCs
Processes:
namdoitntn.exereal.exesafert44.exetag.exekukurzka9000.exeF0geI.exeEU1.exeHappyRoot.exeffnameedit.exejshainx.exeMinecraftForge.exepid process 224 namdoitntn.exe 628 real.exe 3840 safert44.exe 4532 tag.exe 332 kukurzka9000.exe 1108 F0geI.exe 4728 EU1.exe 924 HappyRoot.exe 2304 ffnameedit.exe 4372 jshainx.exe 7472 MinecraftForge.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
jshainx.exea3b0afc1b50c24f3760768789e6826ad.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Control Panel\International\Geo\Nation jshainx.exe Key value queried \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Control Panel\International\Geo\Nation a3b0afc1b50c24f3760768789e6826ad.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in Program Files directory 12 IoCs
Processes:
a3b0afc1b50c24f3760768789e6826ad.exesetup.exedescription ioc process File opened for modification C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe a3b0afc1b50c24f3760768789e6826ad.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\real.exe a3b0afc1b50c24f3760768789e6826ad.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\tag.exe a3b0afc1b50c24f3760768789e6826ad.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe a3b0afc1b50c24f3760768789e6826ad.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\90a79ecf-852d-4b89-a7e7-62b4948c6422.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20220802161154.pma setup.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\safert44.exe a3b0afc1b50c24f3760768789e6826ad.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe a3b0afc1b50c24f3760768789e6826ad.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\F0geI.exe a3b0afc1b50c24f3760768789e6826ad.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\HappyRoot.exe a3b0afc1b50c24f3760768789e6826ad.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\jshainx.exe a3b0afc1b50c24f3760768789e6826ad.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\EU1.exe a3b0afc1b50c24f3760768789e6826ad.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 5664 1108 WerFault.exe F0geI.exe -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
msedge.exereal.exemsedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 real.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString real.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString msedge.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 msedge.exe -
Enumerates system info in registry 2 TTPs 7 IoCs
Processes:
msedge.exemsedge.exemsedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Modifies registry class 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 54 IoCs
Processes:
msedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exereal.exemsedge.exemsedge.exemsedge.exejshainx.exetag.exesafert44.exenamdoitntn.exeffnameedit.exeidentity_helper.exeHappyRoot.exemsedge.exepid process 5368 msedge.exe 5368 msedge.exe 6044 msedge.exe 6044 msedge.exe 6060 msedge.exe 6060 msedge.exe 5384 msedge.exe 5384 msedge.exe 5360 msedge.exe 5360 msedge.exe 5424 msedge.exe 5424 msedge.exe 5376 msedge.exe 5376 msedge.exe 5412 msedge.exe 5412 msedge.exe 628 real.exe 628 real.exe 3892 msedge.exe 3892 msedge.exe 1436 msedge.exe 1436 msedge.exe 3892 msedge.exe 3892 msedge.exe 1436 msedge.exe 1436 msedge.exe 796 msedge.exe 796 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 4372 jshainx.exe 4372 jshainx.exe 1436 msedge.exe 1436 msedge.exe 1436 msedge.exe 1436 msedge.exe 4532 tag.exe 4532 tag.exe 3840 safert44.exe 3840 safert44.exe 224 namdoitntn.exe 224 namdoitntn.exe 2304 ffnameedit.exe 2304 ffnameedit.exe 7984 identity_helper.exe 7984 identity_helper.exe 924 HappyRoot.exe 924 HappyRoot.exe 3080 msedge.exe 3080 msedge.exe 3080 msedge.exe 3080 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs
Processes:
msedge.exepid process 796 msedge.exe 796 msedge.exe 796 msedge.exe 796 msedge.exe 796 msedge.exe 796 msedge.exe 796 msedge.exe 796 msedge.exe 796 msedge.exe 796 msedge.exe 796 msedge.exe 796 msedge.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
jshainx.exetag.exesafert44.exenamdoitntn.exeffnameedit.exeHappyRoot.exedescription pid process Token: SeDebugPrivilege 4372 jshainx.exe Token: SeDebugPrivilege 4532 tag.exe Token: SeDebugPrivilege 3840 safert44.exe Token: SeDebugPrivilege 224 namdoitntn.exe Token: SeDebugPrivilege 2304 ffnameedit.exe Token: SeDebugPrivilege 924 HappyRoot.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
msedge.exepid process 796 msedge.exe 796 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a3b0afc1b50c24f3760768789e6826ad.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exedescription pid process target process PID 4564 wrote to memory of 4524 4564 a3b0afc1b50c24f3760768789e6826ad.exe msedge.exe PID 4564 wrote to memory of 4524 4564 a3b0afc1b50c24f3760768789e6826ad.exe msedge.exe PID 4564 wrote to memory of 4544 4564 a3b0afc1b50c24f3760768789e6826ad.exe msedge.exe PID 4564 wrote to memory of 4544 4564 a3b0afc1b50c24f3760768789e6826ad.exe msedge.exe PID 4544 wrote to memory of 4508 4544 msedge.exe msedge.exe PID 4544 wrote to memory of 4508 4544 msedge.exe msedge.exe PID 4564 wrote to memory of 4584 4564 a3b0afc1b50c24f3760768789e6826ad.exe msedge.exe PID 4564 wrote to memory of 4584 4564 a3b0afc1b50c24f3760768789e6826ad.exe msedge.exe PID 4524 wrote to memory of 4472 4524 msedge.exe msedge.exe PID 4524 wrote to memory of 4472 4524 msedge.exe msedge.exe PID 4584 wrote to memory of 1044 4584 msedge.exe msedge.exe PID 4584 wrote to memory of 1044 4584 msedge.exe msedge.exe PID 4564 wrote to memory of 4376 4564 a3b0afc1b50c24f3760768789e6826ad.exe msedge.exe PID 4564 wrote to memory of 4376 4564 a3b0afc1b50c24f3760768789e6826ad.exe msedge.exe PID 4376 wrote to memory of 2644 4376 msedge.exe msedge.exe PID 4376 wrote to memory of 2644 4376 msedge.exe msedge.exe PID 4564 wrote to memory of 2344 4564 a3b0afc1b50c24f3760768789e6826ad.exe msedge.exe PID 4564 wrote to memory of 2344 4564 a3b0afc1b50c24f3760768789e6826ad.exe msedge.exe PID 2344 wrote to memory of 3900 2344 msedge.exe msedge.exe PID 2344 wrote to memory of 3900 2344 msedge.exe msedge.exe PID 4564 wrote to memory of 796 4564 a3b0afc1b50c24f3760768789e6826ad.exe msedge.exe PID 4564 wrote to memory of 796 4564 a3b0afc1b50c24f3760768789e6826ad.exe msedge.exe PID 796 wrote to memory of 2132 796 msedge.exe msedge.exe PID 796 wrote to memory of 2132 796 msedge.exe msedge.exe PID 4564 wrote to memory of 224 4564 a3b0afc1b50c24f3760768789e6826ad.exe namdoitntn.exe PID 4564 wrote to memory of 224 4564 a3b0afc1b50c24f3760768789e6826ad.exe namdoitntn.exe PID 4564 wrote to memory of 224 4564 a3b0afc1b50c24f3760768789e6826ad.exe namdoitntn.exe PID 4564 wrote to memory of 628 4564 a3b0afc1b50c24f3760768789e6826ad.exe real.exe PID 4564 wrote to memory of 628 4564 a3b0afc1b50c24f3760768789e6826ad.exe real.exe PID 4564 wrote to memory of 628 4564 a3b0afc1b50c24f3760768789e6826ad.exe real.exe PID 4564 wrote to memory of 3840 4564 a3b0afc1b50c24f3760768789e6826ad.exe safert44.exe PID 4564 wrote to memory of 3840 4564 a3b0afc1b50c24f3760768789e6826ad.exe safert44.exe PID 4564 wrote to memory of 3840 4564 a3b0afc1b50c24f3760768789e6826ad.exe safert44.exe PID 4564 wrote to memory of 4532 4564 a3b0afc1b50c24f3760768789e6826ad.exe tag.exe PID 4564 wrote to memory of 4532 4564 a3b0afc1b50c24f3760768789e6826ad.exe tag.exe PID 4564 wrote to memory of 4532 4564 a3b0afc1b50c24f3760768789e6826ad.exe tag.exe PID 4564 wrote to memory of 332 4564 a3b0afc1b50c24f3760768789e6826ad.exe kukurzka9000.exe PID 4564 wrote to memory of 332 4564 a3b0afc1b50c24f3760768789e6826ad.exe kukurzka9000.exe PID 4564 wrote to memory of 332 4564 a3b0afc1b50c24f3760768789e6826ad.exe kukurzka9000.exe PID 4564 wrote to memory of 1108 4564 a3b0afc1b50c24f3760768789e6826ad.exe F0geI.exe PID 4564 wrote to memory of 1108 4564 a3b0afc1b50c24f3760768789e6826ad.exe F0geI.exe PID 4564 wrote to memory of 1108 4564 a3b0afc1b50c24f3760768789e6826ad.exe F0geI.exe PID 4564 wrote to memory of 4728 4564 a3b0afc1b50c24f3760768789e6826ad.exe EU1.exe PID 4564 wrote to memory of 4728 4564 a3b0afc1b50c24f3760768789e6826ad.exe EU1.exe PID 4564 wrote to memory of 4728 4564 a3b0afc1b50c24f3760768789e6826ad.exe EU1.exe PID 4564 wrote to memory of 2224 4564 a3b0afc1b50c24f3760768789e6826ad.exe msedge.exe PID 4564 wrote to memory of 2224 4564 a3b0afc1b50c24f3760768789e6826ad.exe msedge.exe PID 2224 wrote to memory of 3892 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 3892 2224 msedge.exe msedge.exe PID 4564 wrote to memory of 924 4564 a3b0afc1b50c24f3760768789e6826ad.exe HappyRoot.exe PID 4564 wrote to memory of 924 4564 a3b0afc1b50c24f3760768789e6826ad.exe HappyRoot.exe PID 4564 wrote to memory of 924 4564 a3b0afc1b50c24f3760768789e6826ad.exe HappyRoot.exe PID 4564 wrote to memory of 4852 4564 a3b0afc1b50c24f3760768789e6826ad.exe msedge.exe PID 4564 wrote to memory of 4852 4564 a3b0afc1b50c24f3760768789e6826ad.exe msedge.exe PID 4852 wrote to memory of 1436 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 1436 4852 msedge.exe msedge.exe PID 4564 wrote to memory of 856 4564 a3b0afc1b50c24f3760768789e6826ad.exe msedge.exe PID 4564 wrote to memory of 856 4564 a3b0afc1b50c24f3760768789e6826ad.exe msedge.exe PID 4564 wrote to memory of 2304 4564 a3b0afc1b50c24f3760768789e6826ad.exe ffnameedit.exe PID 4564 wrote to memory of 2304 4564 a3b0afc1b50c24f3760768789e6826ad.exe ffnameedit.exe PID 4564 wrote to memory of 2304 4564 a3b0afc1b50c24f3760768789e6826ad.exe ffnameedit.exe PID 4564 wrote to memory of 4372 4564 a3b0afc1b50c24f3760768789e6826ad.exe jshainx.exe PID 4564 wrote to memory of 4372 4564 a3b0afc1b50c24f3760768789e6826ad.exe jshainx.exe PID 4564 wrote to memory of 4372 4564 a3b0afc1b50c24f3760768789e6826ad.exe jshainx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a3b0afc1b50c24f3760768789e6826ad.exe"C:\Users\Admin\AppData\Local\Temp\a3b0afc1b50c24f3760768789e6826ad.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1RyjC42⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd7cfa46f8,0x7ffd7cfa4708,0x7ffd7cfa47183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,8218456614014308712,16875773837142827035,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,8218456614014308712,16875773837142827035,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1A4aK42⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd7cfa46f8,0x7ffd7cfa4708,0x7ffd7cfa47183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,5056327866721333614,11738602384205312898,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1RLtX42⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd7cfa46f8,0x7ffd7cfa4708,0x7ffd7cfa47183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1536,12062891933344742459,14085678625061841284,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1RCgX42⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd7cfa46f8,0x7ffd7cfa4708,0x7ffd7cfa47183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,7333040859767836651,16455281122647973055,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1n7LH42⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd7cfa46f8,0x7ffd7cfa4708,0x7ffd7cfa47183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1536,8905102286453059014,17637701313421355756,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1nfDK42⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd7cfa46f8,0x7ffd7cfa4708,0x7ffd7cfa47183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,18119659466593462492,9027333941662315558,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,18119659466593462492,9027333941662315558,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,18119659466593462492,9027333941662315558,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,18119659466593462492,9027333941662315558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,18119659466593462492,9027333941662315558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,18119659466593462492,9027333941662315558,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,18119659466593462492,9027333941662315558,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,18119659466593462492,9027333941662315558,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,18119659466593462492,9027333941662315558,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,18119659466593462492,9027333941662315558,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,18119659466593462492,9027333941662315558,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,18119659466593462492,9027333941662315558,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,18119659466593462492,9027333941662315558,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3884 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2168,18119659466593462492,9027333941662315558,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6996 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2168,18119659466593462492,9027333941662315558,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6816 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,18119659466593462492,9027333941662315558,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,18119659466593462492,9027333941662315558,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7040 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,18119659466593462492,9027333941662315558,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8764 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings3⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff6431e5460,0x7ff6431e5470,0x7ff6431e54804⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,18119659466593462492,9027333941662315558,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8764 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2168,18119659466593462492,9027333941662315558,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=9108 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,18119659466593462492,9027333941662315558,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2516 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2168,18119659466593462492,9027333941662315558,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3776 /prefetch:83⤵
-
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe"C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Company\NewProduct\real.exe"C:\Program Files (x86)\Company\NewProduct\real.exe"2⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Company\NewProduct\safert44.exe"C:\Program Files (x86)\Company\NewProduct\safert44.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Company\NewProduct\tag.exe"C:\Program Files (x86)\Company\NewProduct\tag.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe"C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe"2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Company\NewProduct\F0geI.exe"C:\Program Files (x86)\Company\NewProduct\F0geI.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1108 -s 5523⤵
- Program crash
-
C:\Program Files (x86)\Company\NewProduct\EU1.exe"C:\Program Files (x86)\Company\NewProduct\EU1.exe"2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1Ay2Z42⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd7cfa46f8,0x7ffd7cfa4708,0x7ffd7cfa47183⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,11638907906985512711,12256679124435302133,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,11638907906985512711,12256679124435302133,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Company\NewProduct\HappyRoot.exe"C:\Program Files (x86)\Company\NewProduct\HappyRoot.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1R7EV42⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd7cfa46f8,0x7ffd7cfa4708,0x7ffd7cfa47183⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,11765835925188772688,17394704902561548444,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,11765835925188772688,17394704902561548444,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1R9EV42⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd7cfa46f8,0x7ffd7cfa4708,0x7ffd7cfa47183⤵
-
C:\Program Files (x86)\Company\NewProduct\jshainx.exe"C:\Program Files (x86)\Company\NewProduct\jshainx.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\MinecraftForge.exe"C:\Users\Admin\AppData\Local\Temp\MinecraftForge.exe"3⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe"C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1108 -ip 11081⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Company\NewProduct\EU1.exeFilesize
289KB
MD598ee616bbbdae32bd744f31d48e46c72
SHA1fb2fe19e8890c7c4be116db78254fe3e1beb08a0
SHA2565e0e8817946e234867eb10b92ce613a12d1597ca53e73020ec19e1c76b3566cb
SHA512fab7fc5c37551ca64daad4611b62d456ed245946298f1b813120ca0fe45ffb76c29ec8402327e58c565fdf42f2b1d0bd18864b4ab63f85742e2b99772981af9d
-
C:\Program Files (x86)\Company\NewProduct\EU1.exeFilesize
289KB
MD598ee616bbbdae32bd744f31d48e46c72
SHA1fb2fe19e8890c7c4be116db78254fe3e1beb08a0
SHA2565e0e8817946e234867eb10b92ce613a12d1597ca53e73020ec19e1c76b3566cb
SHA512fab7fc5c37551ca64daad4611b62d456ed245946298f1b813120ca0fe45ffb76c29ec8402327e58c565fdf42f2b1d0bd18864b4ab63f85742e2b99772981af9d
-
C:\Program Files (x86)\Company\NewProduct\F0geI.exeFilesize
178KB
MD58d24da259cd54db3ede2745724dbedab
SHA196f51cc49e1a6989dea96f382f2a958f488662a9
SHA25642f46c886e929d455bc3adbd693150d16f94aa48b050cfa463e399521c50e883
SHA512ec005a5ae8585088733fb692d78bbf2ff0f4f395c4b734e9d3bed66d6a73c2ee24c02da20351397768f2420c703ad47ffee785a2a2af455a000ab0e6620ec536
-
C:\Program Files (x86)\Company\NewProduct\F0geI.exeFilesize
178KB
MD58d24da259cd54db3ede2745724dbedab
SHA196f51cc49e1a6989dea96f382f2a958f488662a9
SHA25642f46c886e929d455bc3adbd693150d16f94aa48b050cfa463e399521c50e883
SHA512ec005a5ae8585088733fb692d78bbf2ff0f4f395c4b734e9d3bed66d6a73c2ee24c02da20351397768f2420c703ad47ffee785a2a2af455a000ab0e6620ec536
-
C:\Program Files (x86)\Company\NewProduct\HappyRoot.exeFilesize
107KB
MD50ad2faba47ab5f5933c240ece1ea7075
SHA16479bc7cedfc416856a700eda0d83bd5121b11f9
SHA25681cde4aac3ccad7227fa643504b0c7f26084951df6cb668671932079e13d923b
SHA51272011e4a5a0a90a79dcd2f8347afa2cf8dcd3f3feec2dbac8ab18941cd981f2f5aa730973d377f09f7b211b665be1974474d9e29ecabfba86cf12b3f188a3f32
-
C:\Program Files (x86)\Company\NewProduct\HappyRoot.exeFilesize
107KB
MD50ad2faba47ab5f5933c240ece1ea7075
SHA16479bc7cedfc416856a700eda0d83bd5121b11f9
SHA25681cde4aac3ccad7227fa643504b0c7f26084951df6cb668671932079e13d923b
SHA51272011e4a5a0a90a79dcd2f8347afa2cf8dcd3f3feec2dbac8ab18941cd981f2f5aa730973d377f09f7b211b665be1974474d9e29ecabfba86cf12b3f188a3f32
-
C:\Program Files (x86)\Company\NewProduct\ffnameedit.exeFilesize
107KB
MD56508c44c191fdfec8ef216075c3ed9db
SHA18edc1b2f02a21ab447449fa6f0f269508c293d92
SHA256e45a84d2f0c0ed2ede9220f4350deaaadfcf71b9e97c4ced97e383c3a3b9c917
SHA512c563e60500d783c783874586bd74562d7fd78855b219342ddb0743845ca13f1868dccc39c6460d558d5b644fdaa4688a66e1b454c06348025e8ced1f496038bf
-
C:\Program Files (x86)\Company\NewProduct\ffnameedit.exeFilesize
107KB
MD56508c44c191fdfec8ef216075c3ed9db
SHA18edc1b2f02a21ab447449fa6f0f269508c293d92
SHA256e45a84d2f0c0ed2ede9220f4350deaaadfcf71b9e97c4ced97e383c3a3b9c917
SHA512c563e60500d783c783874586bd74562d7fd78855b219342ddb0743845ca13f1868dccc39c6460d558d5b644fdaa4688a66e1b454c06348025e8ced1f496038bf
-
C:\Program Files (x86)\Company\NewProduct\jshainx.exeFilesize
107KB
MD52647a5be31a41a39bf2497125018dbce
SHA1a1ac856b9d6556f5bb3370f0342914eb7cbb8840
SHA25684c7458316adf09943e459b4fb1aa79bd359ec1516e0ad947f44bdc6c0931665
SHA51268f70140af2ad71a40b6c884627047cdcbc92b4c6f851131e61dc9db3658bde99c1a09cad88c7c922aa5873ab6829cf4100dc12b75f237b2465e22770657ae26
-
C:\Program Files (x86)\Company\NewProduct\jshainx.exeFilesize
107KB
MD52647a5be31a41a39bf2497125018dbce
SHA1a1ac856b9d6556f5bb3370f0342914eb7cbb8840
SHA25684c7458316adf09943e459b4fb1aa79bd359ec1516e0ad947f44bdc6c0931665
SHA51268f70140af2ad71a40b6c884627047cdcbc92b4c6f851131e61dc9db3658bde99c1a09cad88c7c922aa5873ab6829cf4100dc12b75f237b2465e22770657ae26
-
C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exeFilesize
699KB
MD5591fe3c4a7613d32309af09848c88233
SHA18170fce4ede2b4769fad1bec999db5d6a138fbb1
SHA2569f289f95453c588a9ff4bef57b59d6ec812e985b14fdae4554b7112e52819e9d
SHA512e1b3c7c3a807814a7a8139e7043053d12820bdd18c6e4d1320818f9f8b0e1c98a0786425c2d68ad7f789160f816eaa367402af5c67f2e204b9ec0831c1a04f6c
-
C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exeFilesize
699KB
MD5591fe3c4a7613d32309af09848c88233
SHA18170fce4ede2b4769fad1bec999db5d6a138fbb1
SHA2569f289f95453c588a9ff4bef57b59d6ec812e985b14fdae4554b7112e52819e9d
SHA512e1b3c7c3a807814a7a8139e7043053d12820bdd18c6e4d1320818f9f8b0e1c98a0786425c2d68ad7f789160f816eaa367402af5c67f2e204b9ec0831c1a04f6c
-
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exeFilesize
245KB
MD5b16134159e66a72fb36d93bc703b4188
SHA1e869e91a2b0f77e7ac817e0b30a9a23d537b3001
SHA256b064af166491cb307cfcb9ce53c09696d9d3f6bfa65dfc60b237c275be9b655c
SHA5123fdf205ca16de89c7ed382ed42f628e1211f3e5aff5bf7dedc47927f3dd7ff54b0dd10b4e8282b9693f45a5ee7a26234f899d14bfd8eb0fd078b42a4ed8b8b4c
-
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exeFilesize
245KB
MD5b16134159e66a72fb36d93bc703b4188
SHA1e869e91a2b0f77e7ac817e0b30a9a23d537b3001
SHA256b064af166491cb307cfcb9ce53c09696d9d3f6bfa65dfc60b237c275be9b655c
SHA5123fdf205ca16de89c7ed382ed42f628e1211f3e5aff5bf7dedc47927f3dd7ff54b0dd10b4e8282b9693f45a5ee7a26234f899d14bfd8eb0fd078b42a4ed8b8b4c
-
C:\Program Files (x86)\Company\NewProduct\real.exeFilesize
289KB
MD584d016c5a9e810c2ef08767805a87589
SHA1750b15c9c1acdfcd1396ecec11ab109706a945ad
SHA2566e8bae93bead10d8778a8f442828aac20a0bd5c87cabe3f6d76282a9d47b7845
SHA5127c612dd0f3eab6cb602c12390f62daa0e75d83433bcd4b682d1d5b931ebc52c8f6b32acd12474bdf6eecb91541dfa11cbbd57ca6cf8297ae9c407923e4d95953
-
C:\Program Files (x86)\Company\NewProduct\real.exeFilesize
289KB
MD584d016c5a9e810c2ef08767805a87589
SHA1750b15c9c1acdfcd1396ecec11ab109706a945ad
SHA2566e8bae93bead10d8778a8f442828aac20a0bd5c87cabe3f6d76282a9d47b7845
SHA5127c612dd0f3eab6cb602c12390f62daa0e75d83433bcd4b682d1d5b931ebc52c8f6b32acd12474bdf6eecb91541dfa11cbbd57ca6cf8297ae9c407923e4d95953
-
C:\Program Files (x86)\Company\NewProduct\safert44.exeFilesize
244KB
MD5dbe947674ea388b565ae135a09cc6638
SHA1ae8e1c69bd1035a92b7e06baad5e387de3a70572
SHA25686aeac2a4ee8e62265ee570718bbd41a4e643e0bad69e7b4fa6c24baeb220709
SHA51267441aebbf7ce4d53fbb665124f309faed7842b3e424e018454ff6d6f790219633ce6a9b370aeaf77c5092e84f4391df13e964ca6a28597810dee41c3c833893
-
C:\Program Files (x86)\Company\NewProduct\safert44.exeFilesize
244KB
MD5dbe947674ea388b565ae135a09cc6638
SHA1ae8e1c69bd1035a92b7e06baad5e387de3a70572
SHA25686aeac2a4ee8e62265ee570718bbd41a4e643e0bad69e7b4fa6c24baeb220709
SHA51267441aebbf7ce4d53fbb665124f309faed7842b3e424e018454ff6d6f790219633ce6a9b370aeaf77c5092e84f4391df13e964ca6a28597810dee41c3c833893
-
C:\Program Files (x86)\Company\NewProduct\tag.exeFilesize
107KB
MD52ebc22860c7d9d308c018f0ffb5116ff
SHA178791a83f7161e58f9b7df45f9be618e9daea4cd
SHA2568e2c9fd68fc850fa610d1edfd46fc4a66adbef24e42a1841290b0e0c08597e89
SHA512d4842627f6fab09f9472ed0b09b5e012524bf6b821d90a753275f68de65b7ba084a9e15daca58a183f89b166cc9d2d2f2d6a81e1110e66c5822b548279c8c05e
-
C:\Program Files (x86)\Company\NewProduct\tag.exeFilesize
107KB
MD52ebc22860c7d9d308c018f0ffb5116ff
SHA178791a83f7161e58f9b7df45f9be618e9daea4cd
SHA2568e2c9fd68fc850fa610d1edfd46fc4a66adbef24e42a1841290b0e0c08597e89
SHA512d4842627f6fab09f9472ed0b09b5e012524bf6b821d90a753275f68de65b7ba084a9e15daca58a183f89b166cc9d2d2f2d6a81e1110e66c5822b548279c8c05e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53Filesize
471B
MD5a773a4d66bd5ab3efb4448e4ca400f23
SHA19f4a3e6d3c2935ed9d4e510f4866c54833c3b6fd
SHA256f945ec405a5296dbc9161f37ba434498701aa7b266df38c920fe8c1635ab5dd9
SHA51232ec2421361d449fde7eb0c71efbc55bccfb2af22964b5c252b66965f93689b387ea3404358bbe7b107294e38b5ca811d9669253249c2f93bbae0b3480ce6a43
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53Filesize
412B
MD54703df895e8f3ca9b2efa3cf1343b359
SHA16ec1d1cc833030a4f349c8e7b4a80a35401869e0
SHA25628248e5b1b3b014f9a5684d119ba489120b1be7449fad3a6e6838cd37ad964ac
SHA512ad96e108b017914b3ca02f1ad2ecaa3d2148282db699667e2a636a1561bc75c9b2aad1ed2b8807fb22331ba30aefd58f87ff40dea95b46d66f6dddc310240e54
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD539d33ed8e39d48cbbe10137b840a938a
SHA1af463ffd0fe9508fb7c71585709eaada860626bc
SHA256d2dd2e1482b5a8808b7a88a8979fa6ad2ded1a99a0b6c83ddcc3004261d01451
SHA51218c96d2add074aaa3dd470ba01f104be0f107d51417bc8c8a609f69a444e598049b3fbe4d2a84f29b7e59e0aa5de474655735418d2838e8efe20aa675b96f6bc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD539d33ed8e39d48cbbe10137b840a938a
SHA1af463ffd0fe9508fb7c71585709eaada860626bc
SHA256d2dd2e1482b5a8808b7a88a8979fa6ad2ded1a99a0b6c83ddcc3004261d01451
SHA51218c96d2add074aaa3dd470ba01f104be0f107d51417bc8c8a609f69a444e598049b3fbe4d2a84f29b7e59e0aa5de474655735418d2838e8efe20aa675b96f6bc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD539d33ed8e39d48cbbe10137b840a938a
SHA1af463ffd0fe9508fb7c71585709eaada860626bc
SHA256d2dd2e1482b5a8808b7a88a8979fa6ad2ded1a99a0b6c83ddcc3004261d01451
SHA51218c96d2add074aaa3dd470ba01f104be0f107d51417bc8c8a609f69a444e598049b3fbe4d2a84f29b7e59e0aa5de474655735418d2838e8efe20aa675b96f6bc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD539d33ed8e39d48cbbe10137b840a938a
SHA1af463ffd0fe9508fb7c71585709eaada860626bc
SHA256d2dd2e1482b5a8808b7a88a8979fa6ad2ded1a99a0b6c83ddcc3004261d01451
SHA51218c96d2add074aaa3dd470ba01f104be0f107d51417bc8c8a609f69a444e598049b3fbe4d2a84f29b7e59e0aa5de474655735418d2838e8efe20aa675b96f6bc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD539d33ed8e39d48cbbe10137b840a938a
SHA1af463ffd0fe9508fb7c71585709eaada860626bc
SHA256d2dd2e1482b5a8808b7a88a8979fa6ad2ded1a99a0b6c83ddcc3004261d01451
SHA51218c96d2add074aaa3dd470ba01f104be0f107d51417bc8c8a609f69a444e598049b3fbe4d2a84f29b7e59e0aa5de474655735418d2838e8efe20aa675b96f6bc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD539d33ed8e39d48cbbe10137b840a938a
SHA1af463ffd0fe9508fb7c71585709eaada860626bc
SHA256d2dd2e1482b5a8808b7a88a8979fa6ad2ded1a99a0b6c83ddcc3004261d01451
SHA51218c96d2add074aaa3dd470ba01f104be0f107d51417bc8c8a609f69a444e598049b3fbe4d2a84f29b7e59e0aa5de474655735418d2838e8efe20aa675b96f6bc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD539d33ed8e39d48cbbe10137b840a938a
SHA1af463ffd0fe9508fb7c71585709eaada860626bc
SHA256d2dd2e1482b5a8808b7a88a8979fa6ad2ded1a99a0b6c83ddcc3004261d01451
SHA51218c96d2add074aaa3dd470ba01f104be0f107d51417bc8c8a609f69a444e598049b3fbe4d2a84f29b7e59e0aa5de474655735418d2838e8efe20aa675b96f6bc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD539d33ed8e39d48cbbe10137b840a938a
SHA1af463ffd0fe9508fb7c71585709eaada860626bc
SHA256d2dd2e1482b5a8808b7a88a8979fa6ad2ded1a99a0b6c83ddcc3004261d01451
SHA51218c96d2add074aaa3dd470ba01f104be0f107d51417bc8c8a609f69a444e598049b3fbe4d2a84f29b7e59e0aa5de474655735418d2838e8efe20aa675b96f6bc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD539d33ed8e39d48cbbe10137b840a938a
SHA1af463ffd0fe9508fb7c71585709eaada860626bc
SHA256d2dd2e1482b5a8808b7a88a8979fa6ad2ded1a99a0b6c83ddcc3004261d01451
SHA51218c96d2add074aaa3dd470ba01f104be0f107d51417bc8c8a609f69a444e598049b3fbe4d2a84f29b7e59e0aa5de474655735418d2838e8efe20aa675b96f6bc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD539d33ed8e39d48cbbe10137b840a938a
SHA1af463ffd0fe9508fb7c71585709eaada860626bc
SHA256d2dd2e1482b5a8808b7a88a8979fa6ad2ded1a99a0b6c83ddcc3004261d01451
SHA51218c96d2add074aaa3dd470ba01f104be0f107d51417bc8c8a609f69a444e598049b3fbe4d2a84f29b7e59e0aa5de474655735418d2838e8efe20aa675b96f6bc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD539d33ed8e39d48cbbe10137b840a938a
SHA1af463ffd0fe9508fb7c71585709eaada860626bc
SHA256d2dd2e1482b5a8808b7a88a8979fa6ad2ded1a99a0b6c83ddcc3004261d01451
SHA51218c96d2add074aaa3dd470ba01f104be0f107d51417bc8c8a609f69a444e598049b3fbe4d2a84f29b7e59e0aa5de474655735418d2838e8efe20aa675b96f6bc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD539d33ed8e39d48cbbe10137b840a938a
SHA1af463ffd0fe9508fb7c71585709eaada860626bc
SHA256d2dd2e1482b5a8808b7a88a8979fa6ad2ded1a99a0b6c83ddcc3004261d01451
SHA51218c96d2add074aaa3dd470ba01f104be0f107d51417bc8c8a609f69a444e598049b3fbe4d2a84f29b7e59e0aa5de474655735418d2838e8efe20aa675b96f6bc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD539d33ed8e39d48cbbe10137b840a938a
SHA1af463ffd0fe9508fb7c71585709eaada860626bc
SHA256d2dd2e1482b5a8808b7a88a8979fa6ad2ded1a99a0b6c83ddcc3004261d01451
SHA51218c96d2add074aaa3dd470ba01f104be0f107d51417bc8c8a609f69a444e598049b3fbe4d2a84f29b7e59e0aa5de474655735418d2838e8efe20aa675b96f6bc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD539d33ed8e39d48cbbe10137b840a938a
SHA1af463ffd0fe9508fb7c71585709eaada860626bc
SHA256d2dd2e1482b5a8808b7a88a8979fa6ad2ded1a99a0b6c83ddcc3004261d01451
SHA51218c96d2add074aaa3dd470ba01f104be0f107d51417bc8c8a609f69a444e598049b3fbe4d2a84f29b7e59e0aa5de474655735418d2838e8efe20aa675b96f6bc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5c4f48398fdb31b8bd84eadac9ddf5acc
SHA156bc7ec79f71a6f609e12c1c8ca68c9a83c352e5
SHA2568acec190b9fa36a48e95fa130737ceb06cb498c771ff6874ebc47da5825d1746
SHA51216b756eae47dae99f48803625c7a0c30e306a76c27578c829cccf32c9cb52df0aea32bc92d07c7b18fe249cf4fa443e2365d07f0bec4bf47f97af762b7ab3b94
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5c4f48398fdb31b8bd84eadac9ddf5acc
SHA156bc7ec79f71a6f609e12c1c8ca68c9a83c352e5
SHA2568acec190b9fa36a48e95fa130737ceb06cb498c771ff6874ebc47da5825d1746
SHA51216b756eae47dae99f48803625c7a0c30e306a76c27578c829cccf32c9cb52df0aea32bc92d07c7b18fe249cf4fa443e2365d07f0bec4bf47f97af762b7ab3b94
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5c4f48398fdb31b8bd84eadac9ddf5acc
SHA156bc7ec79f71a6f609e12c1c8ca68c9a83c352e5
SHA2568acec190b9fa36a48e95fa130737ceb06cb498c771ff6874ebc47da5825d1746
SHA51216b756eae47dae99f48803625c7a0c30e306a76c27578c829cccf32c9cb52df0aea32bc92d07c7b18fe249cf4fa443e2365d07f0bec4bf47f97af762b7ab3b94
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5c4f48398fdb31b8bd84eadac9ddf5acc
SHA156bc7ec79f71a6f609e12c1c8ca68c9a83c352e5
SHA2568acec190b9fa36a48e95fa130737ceb06cb498c771ff6874ebc47da5825d1746
SHA51216b756eae47dae99f48803625c7a0c30e306a76c27578c829cccf32c9cb52df0aea32bc92d07c7b18fe249cf4fa443e2365d07f0bec4bf47f97af762b7ab3b94
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5c4f48398fdb31b8bd84eadac9ddf5acc
SHA156bc7ec79f71a6f609e12c1c8ca68c9a83c352e5
SHA2568acec190b9fa36a48e95fa130737ceb06cb498c771ff6874ebc47da5825d1746
SHA51216b756eae47dae99f48803625c7a0c30e306a76c27578c829cccf32c9cb52df0aea32bc92d07c7b18fe249cf4fa443e2365d07f0bec4bf47f97af762b7ab3b94
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5c4f48398fdb31b8bd84eadac9ddf5acc
SHA156bc7ec79f71a6f609e12c1c8ca68c9a83c352e5
SHA2568acec190b9fa36a48e95fa130737ceb06cb498c771ff6874ebc47da5825d1746
SHA51216b756eae47dae99f48803625c7a0c30e306a76c27578c829cccf32c9cb52df0aea32bc92d07c7b18fe249cf4fa443e2365d07f0bec4bf47f97af762b7ab3b94
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5c4f48398fdb31b8bd84eadac9ddf5acc
SHA156bc7ec79f71a6f609e12c1c8ca68c9a83c352e5
SHA2568acec190b9fa36a48e95fa130737ceb06cb498c771ff6874ebc47da5825d1746
SHA51216b756eae47dae99f48803625c7a0c30e306a76c27578c829cccf32c9cb52df0aea32bc92d07c7b18fe249cf4fa443e2365d07f0bec4bf47f97af762b7ab3b94
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5c4f48398fdb31b8bd84eadac9ddf5acc
SHA156bc7ec79f71a6f609e12c1c8ca68c9a83c352e5
SHA2568acec190b9fa36a48e95fa130737ceb06cb498c771ff6874ebc47da5825d1746
SHA51216b756eae47dae99f48803625c7a0c30e306a76c27578c829cccf32c9cb52df0aea32bc92d07c7b18fe249cf4fa443e2365d07f0bec4bf47f97af762b7ab3b94
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5c4f48398fdb31b8bd84eadac9ddf5acc
SHA156bc7ec79f71a6f609e12c1c8ca68c9a83c352e5
SHA2568acec190b9fa36a48e95fa130737ceb06cb498c771ff6874ebc47da5825d1746
SHA51216b756eae47dae99f48803625c7a0c30e306a76c27578c829cccf32c9cb52df0aea32bc92d07c7b18fe249cf4fa443e2365d07f0bec4bf47f97af762b7ab3b94
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5c4f48398fdb31b8bd84eadac9ddf5acc
SHA156bc7ec79f71a6f609e12c1c8ca68c9a83c352e5
SHA2568acec190b9fa36a48e95fa130737ceb06cb498c771ff6874ebc47da5825d1746
SHA51216b756eae47dae99f48803625c7a0c30e306a76c27578c829cccf32c9cb52df0aea32bc92d07c7b18fe249cf4fa443e2365d07f0bec4bf47f97af762b7ab3b94
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5c4f48398fdb31b8bd84eadac9ddf5acc
SHA156bc7ec79f71a6f609e12c1c8ca68c9a83c352e5
SHA2568acec190b9fa36a48e95fa130737ceb06cb498c771ff6874ebc47da5825d1746
SHA51216b756eae47dae99f48803625c7a0c30e306a76c27578c829cccf32c9cb52df0aea32bc92d07c7b18fe249cf4fa443e2365d07f0bec4bf47f97af762b7ab3b94
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5c4f48398fdb31b8bd84eadac9ddf5acc
SHA156bc7ec79f71a6f609e12c1c8ca68c9a83c352e5
SHA2568acec190b9fa36a48e95fa130737ceb06cb498c771ff6874ebc47da5825d1746
SHA51216b756eae47dae99f48803625c7a0c30e306a76c27578c829cccf32c9cb52df0aea32bc92d07c7b18fe249cf4fa443e2365d07f0bec4bf47f97af762b7ab3b94
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD51c463718e8121436ae68c90ac3a9ec6f
SHA12479c48406fa53e889b9c081cdc29bb348c4a49a
SHA25651791837d7ee3b44d7a72c819f0a4212d572c709ab31c25813bfbeecf05d7f56
SHA512832afb61f1d2dab7b96ec35f2413f83f27dbcd7c475eafff33d3c2829458db13c6eb82561fab3f3460d46ed765d9dcf6a10896a6eac4a524bb122ed5ff4e54f8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD5ef9696be7a3e3a184e45f49c6b16e2cf
SHA18e440c8e3f330258c574dd622dac194b9a800341
SHA2564186380527a12d450ebbc25d099a1449ababb329af9141550f872482b017c96a
SHA51212997dafb71eb3fb2e4c6d8d646b844f4fcb942f0ba4ad7d2aa265fa4bea000356c38c720d78f8af32c4d0801fa83cdc93ce18fcd9827203fa90bad67a28fd98
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD57de0e73b476f9bcfbc3b524a861bf3dd
SHA1e2c268338cc19303fd47760090023b544b86d1bf
SHA256e9da2ca30bea08f351f521fa7b493e4ce1603abae57ef0e2a54a8ac7f6df7c97
SHA512cd667e8ae10ea5cc3cc3f11544484473604314182b444685ac4c6227b46c713888e38ec8c3bfef8c5989079f9b66f4074d38c38097a6f5eb4afc7374ac9c9af4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD5731223256bbf3d9ceb39b79bdc891295
SHA15f8be76ac880c8ca8daf94ddb0b9689dfae24e8f
SHA256a92260fb22fe570403d6d724cf409b892ad42881f844c3dc6986309aaba92ceb
SHA51216a10b77caafe67bbd34c5684e3d752fc28da5bd9dce458e7f0ef39f5ad75dbfe07669f68b2603ac77a0a074fda8746090c7dee7d872fc1fb9d59c0f675b4b50
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD57de0e73b476f9bcfbc3b524a861bf3dd
SHA1e2c268338cc19303fd47760090023b544b86d1bf
SHA256e9da2ca30bea08f351f521fa7b493e4ce1603abae57ef0e2a54a8ac7f6df7c97
SHA512cd667e8ae10ea5cc3cc3f11544484473604314182b444685ac4c6227b46c713888e38ec8c3bfef8c5989079f9b66f4074d38c38097a6f5eb4afc7374ac9c9af4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD5ef9696be7a3e3a184e45f49c6b16e2cf
SHA18e440c8e3f330258c574dd622dac194b9a800341
SHA2564186380527a12d450ebbc25d099a1449ababb329af9141550f872482b017c96a
SHA51212997dafb71eb3fb2e4c6d8d646b844f4fcb942f0ba4ad7d2aa265fa4bea000356c38c720d78f8af32c4d0801fa83cdc93ce18fcd9827203fa90bad67a28fd98
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD5cc0ed72a66f0cb6720724c29b6467b40
SHA14aaeb061f663d32a09ec84264d47b7403be3fc3d
SHA2561d6e9b2c7224cd56cbbc5ca7edf26717de9752b9081ffa14b0c933f2b89a6c30
SHA512e110e5efde9b0ce88c3d7e0996d317069d4d0f96839d4fdd2aca96fa8951639c98d76d16ffe0531380b01cac03bad8e065675ee6ae075a081c1bad60458a74b9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD5330c8dda61aeb897a2059d7c6e98f059
SHA18d286fc29f74c7bea514886b15b76a7ad5f3fb99
SHA2567c4396e2fd7076eb1926b1bee3b8506fd0197a8fd7639dff0b45351e63c24d77
SHA5123ddb570a95b326ff8202a3b7f975c862f9c9200ca6d32e773ce2fccd6a0172d63a8488735345d70e441f8a81035411e72458c0df3622379f297e40d022c05dfa
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD59e60f45ac7b964df967b652daeddddc6
SHA190518be12247ac1e4284f59662886d847cfcf8cc
SHA256f3e3df82acd749080fd38011b72f957b1fa40b7b6a862e5e0859b76afbc83a33
SHA5126066457a73b6ab019bcb9d17fdb0168447e95fedc7eaa398695ba433d71e12fad16000879df1736e71b9a726e1f6c19af022a4066213eee3dd4cd6ca8c2a4476
-
\??\pipe\LOCAL\crashpad_2224_HBGNZSXNKLKKNOLGMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\LOCAL\crashpad_4524_RMGKGBBPEITKODRDMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\LOCAL\crashpad_4852_IWISOLVGLFIDKCOBMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\LOCAL\crashpad_796_AGWCPMLDSCCWQJBRMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/224-164-0x0000000000040000-0x0000000000084000-memory.dmpFilesize
272KB
-
memory/224-305-0x00000000058C0000-0x0000000005926000-memory.dmpFilesize
408KB
-
memory/224-147-0x0000000000000000-mapping.dmp
-
memory/332-180-0x00000000005F0000-0x0000000000606000-memory.dmpFilesize
88KB
-
memory/332-288-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/332-157-0x0000000000000000-mapping.dmp
-
memory/332-181-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/628-150-0x0000000000000000-mapping.dmp
-
memory/628-208-0x0000000060900000-0x0000000060992000-memory.dmpFilesize
584KB
-
memory/796-143-0x0000000000000000-mapping.dmp
-
memory/856-194-0x0000000000000000-mapping.dmp
-
memory/924-182-0x0000000000000000-mapping.dmp
-
memory/924-186-0x0000000000320000-0x0000000000340000-memory.dmpFilesize
128KB
-
memory/924-191-0x0000000004D00000-0x0000000004E0A000-memory.dmpFilesize
1.0MB
-
memory/924-189-0x0000000005210000-0x0000000005828000-memory.dmpFilesize
6.1MB
-
memory/1044-135-0x0000000000000000-mapping.dmp
-
memory/1108-261-0x0000000000400000-0x000000000062B000-memory.dmpFilesize
2.2MB
-
memory/1108-165-0x0000000000000000-mapping.dmp
-
memory/1108-257-0x00000000001E0000-0x00000000001EF000-memory.dmpFilesize
60KB
-
memory/1108-250-0x00000000007D3000-0x00000000007E4000-memory.dmpFilesize
68KB
-
memory/1108-295-0x0000000000400000-0x000000000062B000-memory.dmpFilesize
2.2MB
-
memory/1108-294-0x00000000007D3000-0x00000000007E4000-memory.dmpFilesize
68KB
-
memory/1436-187-0x0000000000000000-mapping.dmp
-
memory/1544-214-0x0000000000000000-mapping.dmp
-
memory/1596-321-0x0000000000000000-mapping.dmp
-
memory/1596-297-0x0000000000000000-mapping.dmp
-
memory/2132-145-0x0000000000000000-mapping.dmp
-
memory/2224-177-0x0000000000000000-mapping.dmp
-
memory/2304-202-0x00000000002A0000-0x00000000002C0000-memory.dmpFilesize
128KB
-
memory/2304-308-0x0000000008600000-0x0000000008B2C000-memory.dmpFilesize
5.2MB
-
memory/2304-307-0x0000000007F00000-0x00000000080C2000-memory.dmpFilesize
1.8MB
-
memory/2304-195-0x0000000000000000-mapping.dmp
-
memory/2344-141-0x0000000000000000-mapping.dmp
-
memory/2644-139-0x0000000000000000-mapping.dmp
-
memory/3080-319-0x0000000000000000-mapping.dmp
-
memory/3684-293-0x0000000000000000-mapping.dmp
-
memory/3840-190-0x00000000051D0000-0x00000000051E2000-memory.dmpFilesize
72KB
-
memory/3840-303-0x00000000068B0000-0x0000000006E54000-memory.dmpFilesize
5.6MB
-
memory/3840-162-0x0000000000800000-0x0000000000844000-memory.dmpFilesize
272KB
-
memory/3840-304-0x00000000056B0000-0x0000000005742000-memory.dmpFilesize
584KB
-
memory/3840-153-0x0000000000000000-mapping.dmp
-
memory/3892-178-0x0000000000000000-mapping.dmp
-
memory/3900-142-0x0000000000000000-mapping.dmp
-
memory/4372-198-0x0000000000000000-mapping.dmp
-
memory/4372-239-0x0000000000DC0000-0x0000000000DE0000-memory.dmpFilesize
128KB
-
memory/4376-136-0x0000000000000000-mapping.dmp
-
memory/4472-134-0x0000000000000000-mapping.dmp
-
memory/4508-132-0x0000000000000000-mapping.dmp
-
memory/4524-130-0x0000000000000000-mapping.dmp
-
memory/4532-163-0x0000000000060000-0x0000000000080000-memory.dmpFilesize
128KB
-
memory/4532-309-0x00000000064E0000-0x0000000006530000-memory.dmpFilesize
320KB
-
memory/4532-306-0x0000000005550000-0x000000000556E000-memory.dmpFilesize
120KB
-
memory/4532-302-0x0000000004C50000-0x0000000004CC6000-memory.dmpFilesize
472KB
-
memory/4532-156-0x0000000000000000-mapping.dmp
-
memory/4532-193-0x0000000004910000-0x000000000494C000-memory.dmpFilesize
240KB
-
memory/4544-131-0x0000000000000000-mapping.dmp
-
memory/4572-207-0x0000000000000000-mapping.dmp
-
memory/4584-133-0x0000000000000000-mapping.dmp
-
memory/4728-173-0x0000000000000000-mapping.dmp
-
memory/4852-185-0x0000000000000000-mapping.dmp
-
memory/4924-291-0x0000000000000000-mapping.dmp
-
memory/5168-282-0x0000000000000000-mapping.dmp
-
memory/5172-318-0x0000000000000000-mapping.dmp
-
memory/5216-215-0x0000000000000000-mapping.dmp
-
memory/5360-217-0x0000000000000000-mapping.dmp
-
memory/5368-218-0x0000000000000000-mapping.dmp
-
memory/5376-219-0x0000000000000000-mapping.dmp
-
memory/5384-220-0x0000000000000000-mapping.dmp
-
memory/5412-237-0x0000000000000000-mapping.dmp
-
memory/5424-238-0x0000000000000000-mapping.dmp
-
memory/5652-299-0x0000000000000000-mapping.dmp
-
memory/5796-245-0x0000000000000000-mapping.dmp
-
memory/5956-247-0x0000000000000000-mapping.dmp
-
memory/5968-249-0x0000000000000000-mapping.dmp
-
memory/6044-252-0x0000000000000000-mapping.dmp
-
memory/6060-253-0x0000000000000000-mapping.dmp
-
memory/6128-280-0x0000000000000000-mapping.dmp
-
memory/6228-264-0x0000000000000000-mapping.dmp
-
memory/6284-284-0x0000000000000000-mapping.dmp
-
memory/6316-266-0x0000000000000000-mapping.dmp
-
memory/6492-289-0x0000000000000000-mapping.dmp
-
memory/6868-286-0x0000000000000000-mapping.dmp
-
memory/6920-301-0x0000000000000000-mapping.dmp
-
memory/7104-276-0x0000000000000000-mapping.dmp
-
memory/7144-278-0x0000000000000000-mapping.dmp
-
memory/7472-310-0x0000000000000000-mapping.dmp
-
memory/7472-315-0x00007FFD77EE0000-0x00007FFD789A1000-memory.dmpFilesize
10.8MB
-
memory/7472-312-0x00007FFD77EE0000-0x00007FFD789A1000-memory.dmpFilesize
10.8MB
-
memory/7472-311-0x00000000006E0000-0x0000000000934000-memory.dmpFilesize
2.3MB
-
memory/7724-313-0x0000000000000000-mapping.dmp
-
memory/7772-314-0x0000000000000000-mapping.dmp
-
memory/7984-316-0x0000000000000000-mapping.dmp