Analysis
-
max time kernel
157s -
max time network
167s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
19-08-2022 05:06
Static task
static1
Behavioral task
behavioral1
Sample
3e8cd0eb4715ef2b9f3b9f676b90eb16b0842d289a34fdd41e46c106a845d983.exe
Resource
win10v2004-20220812-en
General
-
Target
3e8cd0eb4715ef2b9f3b9f676b90eb16b0842d289a34fdd41e46c106a845d983.exe
-
Size
1.1MB
-
MD5
8ccbac1663570c8901fcb75111b07497
-
SHA1
a4772fd7f75d1d755e7494184aa35313182769d2
-
SHA256
3e8cd0eb4715ef2b9f3b9f676b90eb16b0842d289a34fdd41e46c106a845d983
-
SHA512
d9cb06f7bfbbaace59a5834f8ba1cd1e9de1d03370dc550d0b17527a52a09f3f6bb35ccd86ff3ef8b95673300d036779f2158faeefb9a5a7e139f1f8e9a7a96a
Malware Config
Extracted
redline
nam3
103.89.90.61:34589
-
auth_value
64b900120bbceaa6a9c60e9079492895
Extracted
redline
5
176.113.115.146:9582
-
auth_value
d38b30c1ccd6c1e5088d9e5bd9e51b0f
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 6 IoCs
Processes:
resource yara_rule C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe family_redline C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe family_redline C:\Program Files (x86)\Company\NewProduct\safert44.exe family_redline C:\Program Files (x86)\Company\NewProduct\safert44.exe family_redline behavioral1/memory/1908-161-0x00000000003B0000-0x00000000003D0000-memory.dmp family_redline behavioral1/memory/1484-160-0x00000000007A0000-0x00000000007E4000-memory.dmp family_redline -
Downloads MZ/PE file
-
Executes dropped EXE 12 IoCs
Processes:
F0geI.exekukurzka9000.exenamdoitntn.exereal.exesafert44.execaptain09876.exeme.exeSETUP_~1.EXEAlwgckdftdslvwbqpdbjc13t.exeSETUP_~1.EXEAlwgckdftdslvwbqpdbjc13t.exe7952.exepid process 2656 F0geI.exe 3756 kukurzka9000.exe 1908 namdoitntn.exe 3128 real.exe 1484 safert44.exe 1780 captain09876.exe 5088 me.exe 5636 SETUP_~1.EXE 4008 Alwgckdftdslvwbqpdbjc13t.exe 2744 SETUP_~1.EXE 5116 Alwgckdftdslvwbqpdbjc13t.exe 408 7952.exe -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
3e8cd0eb4715ef2b9f3b9f676b90eb16b0842d289a34fdd41e46c106a845d983.exeSETUP_~1.EXEAlwgckdftdslvwbqpdbjc13t.exe7952.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 3e8cd0eb4715ef2b9f3b9f676b90eb16b0842d289a34fdd41e46c106a845d983.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SETUP_~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation Alwgckdftdslvwbqpdbjc13t.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 7952.exe -
Loads dropped DLL 3 IoCs
Processes:
SETUP_~1.EXEpid process 2744 SETUP_~1.EXE 2744 SETUP_~1.EXE 2744 SETUP_~1.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
captain09876.exemsedge.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce captain09876.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" captain09876.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
SETUP_~1.EXEAlwgckdftdslvwbqpdbjc13t.exedescription pid process target process PID 5636 set thread context of 2744 5636 SETUP_~1.EXE SETUP_~1.EXE PID 4008 set thread context of 5116 4008 Alwgckdftdslvwbqpdbjc13t.exe Alwgckdftdslvwbqpdbjc13t.exe -
Drops file in Program Files directory 9 IoCs
Processes:
3e8cd0eb4715ef2b9f3b9f676b90eb16b0842d289a34fdd41e46c106a845d983.exesetup.exedescription ioc process File opened for modification C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe 3e8cd0eb4715ef2b9f3b9f676b90eb16b0842d289a34fdd41e46c106a845d983.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\real.exe 3e8cd0eb4715ef2b9f3b9f676b90eb16b0842d289a34fdd41e46c106a845d983.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\56e35083-af0e-434d-965f-724993f404eb.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20220819070724.pma setup.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\F0geI.exe 3e8cd0eb4715ef2b9f3b9f676b90eb16b0842d289a34fdd41e46c106a845d983.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe 3e8cd0eb4715ef2b9f3b9f676b90eb16b0842d289a34fdd41e46c106a845d983.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\safert44.exe 3e8cd0eb4715ef2b9f3b9f676b90eb16b0842d289a34fdd41e46c106a845d983.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\captain09876.exe 3e8cd0eb4715ef2b9f3b9f676b90eb16b0842d289a34fdd41e46c106a845d983.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\me.exe 3e8cd0eb4715ef2b9f3b9f676b90eb16b0842d289a34fdd41e46c106a845d983.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3140 2656 WerFault.exe F0geI.exe 2452 5208 WerFault.exe explorer.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
Alwgckdftdslvwbqpdbjc13t.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Alwgckdftdslvwbqpdbjc13t.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Alwgckdftdslvwbqpdbjc13t.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Alwgckdftdslvwbqpdbjc13t.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
real.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 real.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString real.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Modifies registry class 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
msedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exereal.exepowershell.exesafert44.exenamdoitntn.exeidentity_helper.exeSETUP_~1.EXEpowershell.exeAlwgckdftdslvwbqpdbjc13t.exeAlwgckdftdslvwbqpdbjc13t.exepid process 4088 msedge.exe 4088 msedge.exe 3032 msedge.exe 3032 msedge.exe 2696 msedge.exe 2696 msedge.exe 1652 msedge.exe 1652 msedge.exe 1476 msedge.exe 1476 msedge.exe 3944 msedge.exe 3944 msedge.exe 3128 real.exe 3128 real.exe 4512 powershell.exe 4512 powershell.exe 4512 powershell.exe 1484 safert44.exe 1484 safert44.exe 1908 namdoitntn.exe 1908 namdoitntn.exe 1896 identity_helper.exe 1896 identity_helper.exe 5636 SETUP_~1.EXE 5636 SETUP_~1.EXE 2696 powershell.exe 2696 powershell.exe 2696 powershell.exe 4008 Alwgckdftdslvwbqpdbjc13t.exe 4008 Alwgckdftdslvwbqpdbjc13t.exe 5116 Alwgckdftdslvwbqpdbjc13t.exe 5116 Alwgckdftdslvwbqpdbjc13t.exe 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Alwgckdftdslvwbqpdbjc13t.exepid process 5116 Alwgckdftdslvwbqpdbjc13t.exe 2376 2376 2376 2376 -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
Processes:
msedge.exepid process 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
Processes:
SETUP_~1.EXEpowershell.exesafert44.exenamdoitntn.exeAlwgckdftdslvwbqpdbjc13t.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 5636 SETUP_~1.EXE Token: SeDebugPrivilege 4512 powershell.exe Token: SeDebugPrivilege 1484 safert44.exe Token: SeDebugPrivilege 1908 namdoitntn.exe Token: SeDebugPrivilege 4008 Alwgckdftdslvwbqpdbjc13t.exe Token: SeDebugPrivilege 2696 powershell.exe Token: SeDebugPrivilege 5404 powershell.exe Token: SeShutdownPrivilege 2376 Token: SeCreatePagefilePrivilege 2376 Token: SeShutdownPrivilege 2376 Token: SeCreatePagefilePrivilege 2376 -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
msedge.exepid process 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3e8cd0eb4715ef2b9f3b9f676b90eb16b0842d289a34fdd41e46c106a845d983.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exedescription pid process target process PID 4120 wrote to memory of 320 4120 3e8cd0eb4715ef2b9f3b9f676b90eb16b0842d289a34fdd41e46c106a845d983.exe msedge.exe PID 4120 wrote to memory of 320 4120 3e8cd0eb4715ef2b9f3b9f676b90eb16b0842d289a34fdd41e46c106a845d983.exe msedge.exe PID 4120 wrote to memory of 208 4120 3e8cd0eb4715ef2b9f3b9f676b90eb16b0842d289a34fdd41e46c106a845d983.exe msedge.exe PID 4120 wrote to memory of 208 4120 3e8cd0eb4715ef2b9f3b9f676b90eb16b0842d289a34fdd41e46c106a845d983.exe msedge.exe PID 4120 wrote to memory of 3852 4120 3e8cd0eb4715ef2b9f3b9f676b90eb16b0842d289a34fdd41e46c106a845d983.exe msedge.exe PID 4120 wrote to memory of 3852 4120 3e8cd0eb4715ef2b9f3b9f676b90eb16b0842d289a34fdd41e46c106a845d983.exe msedge.exe PID 4120 wrote to memory of 1476 4120 3e8cd0eb4715ef2b9f3b9f676b90eb16b0842d289a34fdd41e46c106a845d983.exe msedge.exe PID 4120 wrote to memory of 1476 4120 3e8cd0eb4715ef2b9f3b9f676b90eb16b0842d289a34fdd41e46c106a845d983.exe msedge.exe PID 1476 wrote to memory of 4916 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 4916 1476 msedge.exe msedge.exe PID 320 wrote to memory of 3960 320 msedge.exe msedge.exe PID 320 wrote to memory of 3960 320 msedge.exe msedge.exe PID 3852 wrote to memory of 1420 3852 msedge.exe msedge.exe PID 3852 wrote to memory of 1420 3852 msedge.exe msedge.exe PID 208 wrote to memory of 2228 208 msedge.exe msedge.exe PID 208 wrote to memory of 2228 208 msedge.exe msedge.exe PID 4120 wrote to memory of 4680 4120 3e8cd0eb4715ef2b9f3b9f676b90eb16b0842d289a34fdd41e46c106a845d983.exe msedge.exe PID 4120 wrote to memory of 4680 4120 3e8cd0eb4715ef2b9f3b9f676b90eb16b0842d289a34fdd41e46c106a845d983.exe msedge.exe PID 4680 wrote to memory of 536 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 536 4680 msedge.exe msedge.exe PID 4120 wrote to memory of 2656 4120 3e8cd0eb4715ef2b9f3b9f676b90eb16b0842d289a34fdd41e46c106a845d983.exe F0geI.exe PID 4120 wrote to memory of 2656 4120 3e8cd0eb4715ef2b9f3b9f676b90eb16b0842d289a34fdd41e46c106a845d983.exe F0geI.exe PID 4120 wrote to memory of 2656 4120 3e8cd0eb4715ef2b9f3b9f676b90eb16b0842d289a34fdd41e46c106a845d983.exe F0geI.exe PID 4120 wrote to memory of 3756 4120 3e8cd0eb4715ef2b9f3b9f676b90eb16b0842d289a34fdd41e46c106a845d983.exe kukurzka9000.exe PID 4120 wrote to memory of 3756 4120 3e8cd0eb4715ef2b9f3b9f676b90eb16b0842d289a34fdd41e46c106a845d983.exe kukurzka9000.exe PID 4120 wrote to memory of 3756 4120 3e8cd0eb4715ef2b9f3b9f676b90eb16b0842d289a34fdd41e46c106a845d983.exe kukurzka9000.exe PID 4120 wrote to memory of 1908 4120 3e8cd0eb4715ef2b9f3b9f676b90eb16b0842d289a34fdd41e46c106a845d983.exe namdoitntn.exe PID 4120 wrote to memory of 1908 4120 3e8cd0eb4715ef2b9f3b9f676b90eb16b0842d289a34fdd41e46c106a845d983.exe namdoitntn.exe PID 4120 wrote to memory of 1908 4120 3e8cd0eb4715ef2b9f3b9f676b90eb16b0842d289a34fdd41e46c106a845d983.exe namdoitntn.exe PID 4120 wrote to memory of 3128 4120 3e8cd0eb4715ef2b9f3b9f676b90eb16b0842d289a34fdd41e46c106a845d983.exe real.exe PID 4120 wrote to memory of 3128 4120 3e8cd0eb4715ef2b9f3b9f676b90eb16b0842d289a34fdd41e46c106a845d983.exe real.exe PID 4120 wrote to memory of 3128 4120 3e8cd0eb4715ef2b9f3b9f676b90eb16b0842d289a34fdd41e46c106a845d983.exe real.exe PID 4120 wrote to memory of 1484 4120 3e8cd0eb4715ef2b9f3b9f676b90eb16b0842d289a34fdd41e46c106a845d983.exe safert44.exe PID 4120 wrote to memory of 1484 4120 3e8cd0eb4715ef2b9f3b9f676b90eb16b0842d289a34fdd41e46c106a845d983.exe safert44.exe PID 4120 wrote to memory of 1484 4120 3e8cd0eb4715ef2b9f3b9f676b90eb16b0842d289a34fdd41e46c106a845d983.exe safert44.exe PID 4120 wrote to memory of 1780 4120 3e8cd0eb4715ef2b9f3b9f676b90eb16b0842d289a34fdd41e46c106a845d983.exe captain09876.exe PID 4120 wrote to memory of 1780 4120 3e8cd0eb4715ef2b9f3b9f676b90eb16b0842d289a34fdd41e46c106a845d983.exe captain09876.exe PID 4120 wrote to memory of 5088 4120 3e8cd0eb4715ef2b9f3b9f676b90eb16b0842d289a34fdd41e46c106a845d983.exe me.exe PID 4120 wrote to memory of 5088 4120 3e8cd0eb4715ef2b9f3b9f676b90eb16b0842d289a34fdd41e46c106a845d983.exe me.exe PID 4120 wrote to memory of 5088 4120 3e8cd0eb4715ef2b9f3b9f676b90eb16b0842d289a34fdd41e46c106a845d983.exe me.exe PID 4680 wrote to memory of 3056 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 3056 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 3056 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 3056 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 3056 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 3056 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 3056 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 3056 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 3056 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 3056 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 3056 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 3056 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 3056 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 3056 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 3056 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 3056 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 3056 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 3056 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 3056 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 3056 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 3056 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 3056 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 3056 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 3056 4680 msedge.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3e8cd0eb4715ef2b9f3b9f676b90eb16b0842d289a34fdd41e46c106a845d983.exe"C:\Users\Admin\AppData\Local\Temp\3e8cd0eb4715ef2b9f3b9f676b90eb16b0842d289a34fdd41e46c106a845d983.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1RyjC42⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd786446f8,0x7ffd78644708,0x7ffd786447183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,5771149442813850036,1617570796671550076,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,5771149442813850036,1617570796671550076,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1A4aK42⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd786446f8,0x7ffd78644708,0x7ffd786447183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,16199805937411465072,15326625485098544624,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,16199805937411465072,15326625485098544624,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1RLtX42⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd786446f8,0x7ffd78644708,0x7ffd786447183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1528,9893418316855332049,16937889896384925634,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1RCgX42⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffd786446f8,0x7ffd78644708,0x7ffd786447183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,3799196861381448792,10278150245542737917,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2432 /prefetch:23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,3799196861381448792,10278150245542737917,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2484 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,3799196861381448792,10278150245542737917,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,3799196861381448792,10278150245542737917,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3140 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,3799196861381448792,10278150245542737917,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3148 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,3799196861381448792,10278150245542737917,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2744 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,3799196861381448792,10278150245542737917,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,3799196861381448792,10278150245542737917,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4568 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,3799196861381448792,10278150245542737917,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2164,3799196861381448792,10278150245542737917,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5712 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2164,3799196861381448792,10278150245542737917,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5840 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,3799196861381448792,10278150245542737917,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,3799196861381448792,10278150245542737917,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,3799196861381448792,10278150245542737917,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7644 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings3⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x27c,0x280,0x284,0x258,0x288,0x7ff6750c5460,0x7ff6750c5470,0x7ff6750c54804⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,3799196861381448792,10278150245542737917,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7644 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2164,3799196861381448792,10278150245542737917,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1828 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,3799196861381448792,10278150245542737917,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2164,3799196861381448792,10278150245542737917,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2180 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1nXvZ42⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd786446f8,0x7ffd78644708,0x7ffd786447183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,18121441145167405106,16445881201923446215,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,18121441145167405106,16445881201923446215,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Company\NewProduct\F0geI.exe"C:\Program Files (x86)\Company\NewProduct\F0geI.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 7603⤵
- Program crash
-
C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe"C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe"2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe"C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Company\NewProduct\real.exe"C:\Program Files (x86)\Company\NewProduct\real.exe"2⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Company\NewProduct\safert44.exe"C:\Program Files (x86)\Company\NewProduct\safert44.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Company\NewProduct\captain09876.exe"C:\Program Files (x86)\Company\NewProduct\captain09876.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA0AA==4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Alwgckdftdslvwbqpdbjc13t.exe"C:\Users\Admin\AppData\Local\Temp\Alwgckdftdslvwbqpdbjc13t.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA0AA==5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Alwgckdftdslvwbqpdbjc13t.exeC:\Users\Admin\AppData\Local\Temp\Alwgckdftdslvwbqpdbjc13t.exe5⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\Company\NewProduct\me.exe"C:\Program Files (x86)\Company\NewProduct\me.exe"2⤵
- Executes dropped EXE
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2656 -ip 26561⤵
-
C:\Users\Admin\AppData\Local\Temp\7952.exeC:\Users\Admin\AppData\Local\Temp\7952.exe1⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA0AA==2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5208 -s 8722⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5208 -ip 52081⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Company\NewProduct\F0geI.exeFilesize
339KB
MD5501e0f6fa90340e3d7ff26f276cd582e
SHA11bce4a6153f71719e786f8f612fbfcd23d3e130a
SHA256f07d918c6571f11abf9ab7268ac6e2ecbcd931c3d9d878895c777d15052aae2b
SHA512dee3aabfca7912f15b628253222cfe8d8e13cd64f0438e8d705b68b0a14b4c9523b7a207583be7b424e444d6b05f237484a0c38bf2e075d347ef937d409a3a69
-
C:\Program Files (x86)\Company\NewProduct\F0geI.exeFilesize
339KB
MD5501e0f6fa90340e3d7ff26f276cd582e
SHA11bce4a6153f71719e786f8f612fbfcd23d3e130a
SHA256f07d918c6571f11abf9ab7268ac6e2ecbcd931c3d9d878895c777d15052aae2b
SHA512dee3aabfca7912f15b628253222cfe8d8e13cd64f0438e8d705b68b0a14b4c9523b7a207583be7b424e444d6b05f237484a0c38bf2e075d347ef937d409a3a69
-
C:\Program Files (x86)\Company\NewProduct\captain09876.exeFilesize
704KB
MD5ce94ce7de8279ecf9519b12f124543c3
SHA1be2563e381439ed33869a052391eec1ddd40faa0
SHA256f88d6fc5fd36ef3a9c54cf7101728a39a2a2694a0a64f6af1e1befacfbc03f20
SHA5129697cfc31b3344a2929b02ecdf9235756f4641dbb0910e9f6099382916447e2d06e41c153fad50890823f068ae412fb9a55fd274b3b9c7929f2ca972112cc5b7
-
C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exeFilesize
764KB
MD58044b9ea12d49d849f8b516ac3d8173b
SHA168a078e750dad5befd1212a62c903379c1e3525c
SHA25622850fcde13fdc68136d790dee2f85d48069a029a618ceddfd4c6f90b9845d81
SHA51244df6449741275a07f7a3eeb718a1cff7ab6004a5b7501f28fe4269f8601b6ad2a3e6a7beeff0b41e3f2bdf24b6906d49e04b150ae75a33f9537665e4f39eb28
-
C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exeFilesize
764KB
MD58044b9ea12d49d849f8b516ac3d8173b
SHA168a078e750dad5befd1212a62c903379c1e3525c
SHA25622850fcde13fdc68136d790dee2f85d48069a029a618ceddfd4c6f90b9845d81
SHA51244df6449741275a07f7a3eeb718a1cff7ab6004a5b7501f28fe4269f8601b6ad2a3e6a7beeff0b41e3f2bdf24b6906d49e04b150ae75a33f9537665e4f39eb28
-
C:\Program Files (x86)\Company\NewProduct\me.exeFilesize
274KB
MD52eee4c301ce357df8f235957fcb774b3
SHA1f9fd1eac58b5f40475269a1e8eb1675227e2389c
SHA25666cc79df9054fda09648b64a230427d4a574f8349de871e922fbd20432b431f1
SHA512590589c3f8ee16f12539b943ba04402771372fe7748fb689c03b5681466ec8d3f3778007224e0a7fac1413f188aaee59a754cad2d0194af1130a8ad3191466fc
-
C:\Program Files (x86)\Company\NewProduct\me.exeFilesize
274KB
MD52eee4c301ce357df8f235957fcb774b3
SHA1f9fd1eac58b5f40475269a1e8eb1675227e2389c
SHA25666cc79df9054fda09648b64a230427d4a574f8349de871e922fbd20432b431f1
SHA512590589c3f8ee16f12539b943ba04402771372fe7748fb689c03b5681466ec8d3f3778007224e0a7fac1413f188aaee59a754cad2d0194af1130a8ad3191466fc
-
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exeFilesize
107KB
MD5bbd8ea73b7626e0ca5b91d355df39b7f
SHA166e298653beb7f652eb44922010910ced6242879
SHA2561aa3fdc24e789b01a39944b85c99e4ac08864d2eae7530164cea2821acbf184e
SHA512625cc9c108b4660030be1282493700e5f0ccfb973f466f61254ed1e1a96f5f042cdeaa94607825a2f694647468e2f525a6451542fe3aac785ebac1ccfe39864f
-
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exeFilesize
107KB
MD5bbd8ea73b7626e0ca5b91d355df39b7f
SHA166e298653beb7f652eb44922010910ced6242879
SHA2561aa3fdc24e789b01a39944b85c99e4ac08864d2eae7530164cea2821acbf184e
SHA512625cc9c108b4660030be1282493700e5f0ccfb973f466f61254ed1e1a96f5f042cdeaa94607825a2f694647468e2f525a6451542fe3aac785ebac1ccfe39864f
-
C:\Program Files (x86)\Company\NewProduct\real.exeFilesize
275KB
MD5a2414bb5522d3844b6c9a84537d7ce43
SHA156c91fc4fe09ce07320c03f186f3d5d293a6089d
SHA25631f4715777f3be6a4a7b34baf25ebfc7af32dd9a2aae826fc73dca6c44fda173
SHA512408ebb002b3bdb77dc243ced28d852801e68e5ff0dbfa450d3e91b89311fe6a3e8473e749619c285c1a5427d8a117350a3798435ed38b56d1a230f0ae270ec60
-
C:\Program Files (x86)\Company\NewProduct\real.exeFilesize
275KB
MD5a2414bb5522d3844b6c9a84537d7ce43
SHA156c91fc4fe09ce07320c03f186f3d5d293a6089d
SHA25631f4715777f3be6a4a7b34baf25ebfc7af32dd9a2aae826fc73dca6c44fda173
SHA512408ebb002b3bdb77dc243ced28d852801e68e5ff0dbfa450d3e91b89311fe6a3e8473e749619c285c1a5427d8a117350a3798435ed38b56d1a230f0ae270ec60
-
C:\Program Files (x86)\Company\NewProduct\safert44.exeFilesize
246KB
MD5414ffd7094c0f50662ffa508ca43b7d0
SHA16ec67bd53da2ff3d5538a3afcc6797af1e5a53fb
SHA256d3fb9c24b34c113992c5c658f6a11f9620da2e49d12d1acabe871e1bea7846ee
SHA512c6527077b4822c062e32c39be06e285916b501a358991d120a469f5da1e13d282685ca7ca3fa938292d5beef073fbea42ff9ba96fa5c395f057f7c964608a399
-
C:\Program Files (x86)\Company\NewProduct\safert44.exeFilesize
246KB
MD5414ffd7094c0f50662ffa508ca43b7d0
SHA16ec67bd53da2ff3d5538a3afcc6797af1e5a53fb
SHA256d3fb9c24b34c113992c5c658f6a11f9620da2e49d12d1acabe871e1bea7846ee
SHA512c6527077b4822c062e32c39be06e285916b501a358991d120a469f5da1e13d282685ca7ca3fa938292d5beef073fbea42ff9ba96fa5c395f057f7c964608a399
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53Filesize
471B
MD51ba053a6fe8fb69a0d172752a8403ef6
SHA17ddc87014708a8c90fdea555e32b86df4e671282
SHA256104388581d3971502d5207206cc0f65cd345605381620b4fbdeaab7297c126aa
SHA5123879d520cfff0defb371061c5667d2604ef058987522f731902bc4c7210924a6f6e3940b3ca79c513589360628359aca0c880041c562a30060cb5c071bdf13ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53Filesize
412B
MD5783506b86a9319e327868a2a4104dba8
SHA136f4ff6ac448969eda5ed7f02c577c90ffc0f1da
SHA25642a003574bcf78128a0bb79a9d4a27ce4e1ff3068dd41db5f4e7ee195f8966c6
SHA5121d50010ed77698095f71cf6777a5da4341f1859578870f00403c01974cc560ca1fc0655cb7d2508bf2332cf0bcc1640627686fbe2d9d47ab2101c05935d205a5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5af05481b81fdeb6c34b41fa28542b8e1
SHA130982103d4ad165cda1b492f96da553b0d5a8663
SHA25661fabb6e11c5fe6ed58cbe1d1651395b973b7f460ebc78183b02484fad2ef7a2
SHA5126671efa37f6ed5c9faa5b0a063bc6741d2dd217a6bfd578da3d3c8a54b16395916fa2173851bcd597b7489da05fe33095aedc655d0a7df773bd96f814b3b900f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5af05481b81fdeb6c34b41fa28542b8e1
SHA130982103d4ad165cda1b492f96da553b0d5a8663
SHA25661fabb6e11c5fe6ed58cbe1d1651395b973b7f460ebc78183b02484fad2ef7a2
SHA5126671efa37f6ed5c9faa5b0a063bc6741d2dd217a6bfd578da3d3c8a54b16395916fa2173851bcd597b7489da05fe33095aedc655d0a7df773bd96f814b3b900f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5af05481b81fdeb6c34b41fa28542b8e1
SHA130982103d4ad165cda1b492f96da553b0d5a8663
SHA25661fabb6e11c5fe6ed58cbe1d1651395b973b7f460ebc78183b02484fad2ef7a2
SHA5126671efa37f6ed5c9faa5b0a063bc6741d2dd217a6bfd578da3d3c8a54b16395916fa2173851bcd597b7489da05fe33095aedc655d0a7df773bd96f814b3b900f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5af05481b81fdeb6c34b41fa28542b8e1
SHA130982103d4ad165cda1b492f96da553b0d5a8663
SHA25661fabb6e11c5fe6ed58cbe1d1651395b973b7f460ebc78183b02484fad2ef7a2
SHA5126671efa37f6ed5c9faa5b0a063bc6741d2dd217a6bfd578da3d3c8a54b16395916fa2173851bcd597b7489da05fe33095aedc655d0a7df773bd96f814b3b900f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5af05481b81fdeb6c34b41fa28542b8e1
SHA130982103d4ad165cda1b492f96da553b0d5a8663
SHA25661fabb6e11c5fe6ed58cbe1d1651395b973b7f460ebc78183b02484fad2ef7a2
SHA5126671efa37f6ed5c9faa5b0a063bc6741d2dd217a6bfd578da3d3c8a54b16395916fa2173851bcd597b7489da05fe33095aedc655d0a7df773bd96f814b3b900f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5af05481b81fdeb6c34b41fa28542b8e1
SHA130982103d4ad165cda1b492f96da553b0d5a8663
SHA25661fabb6e11c5fe6ed58cbe1d1651395b973b7f460ebc78183b02484fad2ef7a2
SHA5126671efa37f6ed5c9faa5b0a063bc6741d2dd217a6bfd578da3d3c8a54b16395916fa2173851bcd597b7489da05fe33095aedc655d0a7df773bd96f814b3b900f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5af05481b81fdeb6c34b41fa28542b8e1
SHA130982103d4ad165cda1b492f96da553b0d5a8663
SHA25661fabb6e11c5fe6ed58cbe1d1651395b973b7f460ebc78183b02484fad2ef7a2
SHA5126671efa37f6ed5c9faa5b0a063bc6741d2dd217a6bfd578da3d3c8a54b16395916fa2173851bcd597b7489da05fe33095aedc655d0a7df773bd96f814b3b900f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5af05481b81fdeb6c34b41fa28542b8e1
SHA130982103d4ad165cda1b492f96da553b0d5a8663
SHA25661fabb6e11c5fe6ed58cbe1d1651395b973b7f460ebc78183b02484fad2ef7a2
SHA5126671efa37f6ed5c9faa5b0a063bc6741d2dd217a6bfd578da3d3c8a54b16395916fa2173851bcd597b7489da05fe33095aedc655d0a7df773bd96f814b3b900f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD571b657795f1d63721f304fcf46915016
SHA1d2cabf753a2b8888642a3a26878e7f47784153b2
SHA256f6d95ff8ef0a6098a3c31bedf0f623555cf3855bab0142f2350f07eb85832c28
SHA512dd1d8e6e56463cba11da14b604c4dcedf13e1914c4afab93121f6535a30120e0d907c0129c6eebfc8a0a70a557d2f6d467a24fe0bac960c79519049e1931ea20
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD571b657795f1d63721f304fcf46915016
SHA1d2cabf753a2b8888642a3a26878e7f47784153b2
SHA256f6d95ff8ef0a6098a3c31bedf0f623555cf3855bab0142f2350f07eb85832c28
SHA512dd1d8e6e56463cba11da14b604c4dcedf13e1914c4afab93121f6535a30120e0d907c0129c6eebfc8a0a70a557d2f6d467a24fe0bac960c79519049e1931ea20
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD571b657795f1d63721f304fcf46915016
SHA1d2cabf753a2b8888642a3a26878e7f47784153b2
SHA256f6d95ff8ef0a6098a3c31bedf0f623555cf3855bab0142f2350f07eb85832c28
SHA512dd1d8e6e56463cba11da14b604c4dcedf13e1914c4afab93121f6535a30120e0d907c0129c6eebfc8a0a70a557d2f6d467a24fe0bac960c79519049e1931ea20
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD571b657795f1d63721f304fcf46915016
SHA1d2cabf753a2b8888642a3a26878e7f47784153b2
SHA256f6d95ff8ef0a6098a3c31bedf0f623555cf3855bab0142f2350f07eb85832c28
SHA512dd1d8e6e56463cba11da14b604c4dcedf13e1914c4afab93121f6535a30120e0d907c0129c6eebfc8a0a70a557d2f6d467a24fe0bac960c79519049e1931ea20
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD571b657795f1d63721f304fcf46915016
SHA1d2cabf753a2b8888642a3a26878e7f47784153b2
SHA256f6d95ff8ef0a6098a3c31bedf0f623555cf3855bab0142f2350f07eb85832c28
SHA512dd1d8e6e56463cba11da14b604c4dcedf13e1914c4afab93121f6535a30120e0d907c0129c6eebfc8a0a70a557d2f6d467a24fe0bac960c79519049e1931ea20
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD571b657795f1d63721f304fcf46915016
SHA1d2cabf753a2b8888642a3a26878e7f47784153b2
SHA256f6d95ff8ef0a6098a3c31bedf0f623555cf3855bab0142f2350f07eb85832c28
SHA512dd1d8e6e56463cba11da14b604c4dcedf13e1914c4afab93121f6535a30120e0d907c0129c6eebfc8a0a70a557d2f6d467a24fe0bac960c79519049e1931ea20
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\CookiesFilesize
20KB
MD549693267e0adbcd119f9f5e02adf3a80
SHA13ba3d7f89b8ad195ca82c92737e960e1f2b349df
SHA256d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f
SHA512b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web DataFilesize
116KB
MD5f70aa3fa04f0536280f872ad17973c3d
SHA150a7b889329a92de1b272d0ecf5fce87395d3123
SHA2568d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
SHA51230675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD5fc135f6436198c1f22f5857d1fb32f8b
SHA1279aba66c824ba3cc02488ea8773fcd86e4dea3a
SHA2560e514e8a509a785bd82ce76542dce02e3ca3951888d4e88c9c0fbbb77a70c2fc
SHA512fa313374aceb35a82262f2b8442d2c974e7f7ada205e4eeffa08c0f626a2a1684b1bbd8ec3fb3984319929e0e26e2db88692ee10e69b5c3180aac50ecbb2412c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD59a0fa70ca2b671504114681f8d907164
SHA1f6ec8dcd7e834bf22e72e65edeea6807beb06baf
SHA2563004b78119394e73957d7c6e17a9c5134fe156462d383d2d4e4d79baaba4aaf6
SHA5122135282f12652d45acd0631f48703ae955998bda8159ffb030dd21599f14a2970048c9071f27f19a6c6084d0a96d33968e1c4ba46f2b6ea882dc976b46e72c21
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD5e8456f53a66ec625d203618d9bf04915
SHA1fa868510e7ca2210cfb3ef11f852704a9aacf69a
SHA256fd9b2f5cae68470d19f55653b1262e1d69dae1e5237ef4be10765705c51cb713
SHA512f73111c05926ddfd5cc6eba307e5beb578e913f01828079ec62ac3c7a883e3c97d97d41ee3020c76cc1b3ba24f787e35fd221710080ddb39b15f9157ae342b0e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD5c370614d494edadd4efcae046e6aefad
SHA183a225b28fa94039dc44d12d3cf74dee25c7f779
SHA25696f929c8f2334989849fb59eefaeee0df557082754dde1a7d2ecc2a472fd6e5f
SHA51291eb7e2c6f05be84387afb7b7ca8e776ec963aa4a11b478ae32439bccb89d8a9dee8608b55ba079be1f1544e619c23cb14f14cb68651e50373cd427eee67536c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD5e8456f53a66ec625d203618d9bf04915
SHA1fa868510e7ca2210cfb3ef11f852704a9aacf69a
SHA256fd9b2f5cae68470d19f55653b1262e1d69dae1e5237ef4be10765705c51cb713
SHA512f73111c05926ddfd5cc6eba307e5beb578e913f01828079ec62ac3c7a883e3c97d97d41ee3020c76cc1b3ba24f787e35fd221710080ddb39b15f9157ae342b0e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD5fc135f6436198c1f22f5857d1fb32f8b
SHA1279aba66c824ba3cc02488ea8773fcd86e4dea3a
SHA2560e514e8a509a785bd82ce76542dce02e3ca3951888d4e88c9c0fbbb77a70c2fc
SHA512fa313374aceb35a82262f2b8442d2c974e7f7ada205e4eeffa08c0f626a2a1684b1bbd8ec3fb3984319929e0e26e2db88692ee10e69b5c3180aac50ecbb2412c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD59a0fa70ca2b671504114681f8d907164
SHA1f6ec8dcd7e834bf22e72e65edeea6807beb06baf
SHA2563004b78119394e73957d7c6e17a9c5134fe156462d383d2d4e4d79baaba4aaf6
SHA5122135282f12652d45acd0631f48703ae955998bda8159ffb030dd21599f14a2970048c9071f27f19a6c6084d0a96d33968e1c4ba46f2b6ea882dc976b46e72c21
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD53a73976ba11f814646d32b4f27b04fc0
SHA16635c22c100a78f088d57a9431c1eb7cacda82d8
SHA256c062ee6eb30c53526a9a99f2181da2f7a2407bbcf847a91674b98ad449ed89a9
SHA51231ab4a100a7e08943be44444358103691ead5e8f4db260f35612a91c26939d9e51934bdae70db6f9ee489b434b6ab46a783d62c9733cce070f0a3147c6c74715
-
C:\Users\Admin\AppData\Local\Temp\Alwgckdftdslvwbqpdbjc13t.exeFilesize
294KB
MD57559e903cfdd54c5a8bd7a1d6acf6b13
SHA18bc7123940975ad6885abc41d7acc3ad9722b582
SHA25671e95dd74d5a827868e8cfa838f675aabf84bbffc88585f94d53813b0589158d
SHA512d513c14f45c9ae7d864bb04e51bd182fccedd0215db60fdb98d447b11b8baefa165196fae751dd0417ae4aba09844ea916f8a5008ade3e4932fdbe01abcba6ed
-
C:\Users\Admin\AppData\Local\Temp\Alwgckdftdslvwbqpdbjc13t.exeFilesize
294KB
MD57559e903cfdd54c5a8bd7a1d6acf6b13
SHA18bc7123940975ad6885abc41d7acc3ad9722b582
SHA25671e95dd74d5a827868e8cfa838f675aabf84bbffc88585f94d53813b0589158d
SHA512d513c14f45c9ae7d864bb04e51bd182fccedd0215db60fdb98d447b11b8baefa165196fae751dd0417ae4aba09844ea916f8a5008ade3e4932fdbe01abcba6ed
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXEFilesize
334.1MB
MD5ce25658ac9291c713590b834d96406bb
SHA15a45881222b0e35968427eaf3185c9534ad54943
SHA2560dfa582e65cf4e9ea1fd9575518fff57b71b3f0f850df643319c611d39a8c2c2
SHA5128f7bee11566fa8978a0e1716b51ba4e7735e98fc715a9eed0fb3b6e156abfa46f378035935b5ed8967f98bcb3ef83599208a00225bbf0cb2655306846e3d354c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXEFilesize
334.1MB
MD5ce25658ac9291c713590b834d96406bb
SHA15a45881222b0e35968427eaf3185c9534ad54943
SHA2560dfa582e65cf4e9ea1fd9575518fff57b71b3f0f850df643319c611d39a8c2c2
SHA5128f7bee11566fa8978a0e1716b51ba4e7735e98fc715a9eed0fb3b6e156abfa46f378035935b5ed8967f98bcb3ef83599208a00225bbf0cb2655306846e3d354c
-
\??\pipe\LOCAL\crashpad_1476_ZQAJNDFRQMZHGOIEMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\LOCAL\crashpad_208_UHCOJTQLRYCAXUUFMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\LOCAL\crashpad_320_XEGFUJKRPLWXXNYUMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\LOCAL\crashpad_3852_SEOSWOZKEHSJOGYKMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\LOCAL\crashpad_4680_FGXOUQHTEUGLKZMUMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/208-133-0x0000000000000000-mapping.dmp
-
memory/320-132-0x0000000000000000-mapping.dmp
-
memory/364-206-0x0000000000000000-mapping.dmp
-
memory/396-294-0x0000000000000000-mapping.dmp
-
memory/408-300-0x0000015A07860000-0x0000015A07978000-memory.dmpFilesize
1.1MB
-
memory/408-315-0x00007FFD74290000-0x00007FFD74D51000-memory.dmpFilesize
10.8MB
-
memory/408-302-0x0000015A094B0000-0x0000015A094D2000-memory.dmpFilesize
136KB
-
memory/408-303-0x00007FFD74290000-0x00007FFD74D51000-memory.dmpFilesize
10.8MB
-
memory/408-299-0x0000000000000000-mapping.dmp
-
memory/536-141-0x0000000000000000-mapping.dmp
-
memory/1420-138-0x0000000000000000-mapping.dmp
-
memory/1476-135-0x0000000000000000-mapping.dmp
-
memory/1484-277-0x0000000009560000-0x0000000009A8C000-memory.dmpFilesize
5.2MB
-
memory/1484-160-0x00000000007A0000-0x00000000007E4000-memory.dmpFilesize
272KB
-
memory/1484-264-0x00000000055F0000-0x0000000005656000-memory.dmpFilesize
408KB
-
memory/1484-182-0x0000000005390000-0x000000000549A000-memory.dmpFilesize
1.0MB
-
memory/1484-177-0x0000000005800000-0x0000000005E18000-memory.dmpFilesize
6.1MB
-
memory/1484-276-0x0000000008B80000-0x0000000008D42000-memory.dmpFilesize
1.8MB
-
memory/1484-157-0x0000000000000000-mapping.dmp
-
memory/1652-190-0x0000000000000000-mapping.dmp
-
memory/1780-167-0x0000000000000000-mapping.dmp
-
memory/1896-282-0x0000000000000000-mapping.dmp
-
memory/1908-267-0x00000000072A0000-0x0000000007332000-memory.dmpFilesize
584KB
-
memory/1908-266-0x0000000007770000-0x0000000007D14000-memory.dmpFilesize
5.6MB
-
memory/1908-161-0x00000000003B0000-0x00000000003D0000-memory.dmpFilesize
128KB
-
memory/1908-186-0x0000000005630000-0x000000000566C000-memory.dmpFilesize
240KB
-
memory/1908-151-0x0000000000000000-mapping.dmp
-
memory/1908-272-0x0000000007700000-0x0000000007750000-memory.dmpFilesize
320KB
-
memory/1908-271-0x0000000007530000-0x000000000754E000-memory.dmpFilesize
120KB
-
memory/1908-180-0x0000000005700000-0x0000000005712000-memory.dmpFilesize
72KB
-
memory/1908-270-0x00000000073B0000-0x0000000007426000-memory.dmpFilesize
472KB
-
memory/1952-203-0x0000000000000000-mapping.dmp
-
memory/1996-189-0x0000000000000000-mapping.dmp
-
memory/2228-139-0x0000000000000000-mapping.dmp
-
memory/2284-187-0x0000000000000000-mapping.dmp
-
memory/2572-301-0x0000000000000000-mapping.dmp
-
memory/2656-174-0x0000000000400000-0x000000000046E000-memory.dmpFilesize
440KB
-
memory/2656-145-0x0000000000000000-mapping.dmp
-
memory/2656-173-0x00000000006C0000-0x00000000006D0000-memory.dmpFilesize
64KB
-
memory/2656-172-0x000000000077C000-0x000000000078D000-memory.dmpFilesize
68KB
-
memory/2656-262-0x000000000077C000-0x000000000078D000-memory.dmpFilesize
68KB
-
memory/2656-280-0x000000000077C000-0x000000000078D000-memory.dmpFilesize
68KB
-
memory/2696-292-0x0000000000000000-mapping.dmp
-
memory/2696-193-0x0000000000000000-mapping.dmp
-
memory/2744-290-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2744-291-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2744-288-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2744-312-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2744-287-0x0000000000000000-mapping.dmp
-
memory/3032-194-0x0000000000000000-mapping.dmp
-
memory/3056-184-0x0000000000000000-mapping.dmp
-
memory/3128-153-0x0000000000000000-mapping.dmp
-
memory/3128-235-0x0000000060900000-0x0000000060992000-memory.dmpFilesize
584KB
-
memory/3464-281-0x0000000000000000-mapping.dmp
-
memory/3756-148-0x0000000000000000-mapping.dmp
-
memory/3756-227-0x0000000000400000-0x00000000004C5000-memory.dmpFilesize
788KB
-
memory/3756-226-0x00000000026B0000-0x00000000026C2000-memory.dmpFilesize
72KB
-
memory/3852-134-0x0000000000000000-mapping.dmp
-
memory/3896-279-0x0000000000000000-mapping.dmp
-
memory/3944-200-0x0000000000000000-mapping.dmp
-
memory/3960-137-0x0000000000000000-mapping.dmp
-
memory/4008-283-0x0000000000000000-mapping.dmp
-
memory/4008-286-0x0000000000810000-0x0000000000860000-memory.dmpFilesize
320KB
-
memory/4088-188-0x0000000000000000-mapping.dmp
-
memory/4164-209-0x0000000000000000-mapping.dmp
-
memory/4380-196-0x0000000000000000-mapping.dmp
-
memory/4512-274-0x0000000007FB0000-0x000000000862A000-memory.dmpFilesize
6.5MB
-
memory/4512-275-0x0000000006730000-0x000000000674A000-memory.dmpFilesize
104KB
-
memory/4512-273-0x0000000005500000-0x000000000551E000-memory.dmpFilesize
120KB
-
memory/4512-263-0x0000000000000000-mapping.dmp
-
memory/4512-269-0x0000000006080000-0x00000000060E6000-memory.dmpFilesize
408KB
-
memory/4512-268-0x0000000005A50000-0x0000000006078000-memory.dmpFilesize
6.2MB
-
memory/4512-265-0x0000000002E30000-0x0000000002E66000-memory.dmpFilesize
216KB
-
memory/4632-314-0x0000000000000000-mapping.dmp
-
memory/4680-140-0x0000000000000000-mapping.dmp
-
memory/4916-136-0x0000000000000000-mapping.dmp
-
memory/5088-169-0x0000000000000000-mapping.dmp
-
memory/5116-295-0x0000000000000000-mapping.dmp
-
memory/5116-296-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/5116-297-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/5116-298-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/5208-304-0x0000000000000000-mapping.dmp
-
memory/5208-311-0x00000000006F0000-0x000000000075B000-memory.dmpFilesize
428KB
-
memory/5208-307-0x00000000006F0000-0x000000000075B000-memory.dmpFilesize
428KB
-
memory/5208-306-0x0000000000760000-0x00000000007D4000-memory.dmpFilesize
464KB
-
memory/5296-211-0x0000000000000000-mapping.dmp
-
memory/5404-316-0x00007FFD74290000-0x00007FFD74D51000-memory.dmpFilesize
10.8MB
-
memory/5404-305-0x0000000000000000-mapping.dmp
-
memory/5404-310-0x00007FFD74290000-0x00007FFD74D51000-memory.dmpFilesize
10.8MB
-
memory/5480-213-0x0000000000000000-mapping.dmp
-
memory/5612-215-0x0000000000000000-mapping.dmp
-
memory/5636-234-0x0000000000FE0000-0x0000000001030000-memory.dmpFilesize
320KB
-
memory/5636-261-0x00000000067E0000-0x0000000006802000-memory.dmpFilesize
136KB
-
memory/5636-229-0x0000000000000000-mapping.dmp
-
memory/5668-233-0x0000000000000000-mapping.dmp
-
memory/5680-217-0x0000000000000000-mapping.dmp
-
memory/5860-219-0x0000000000000000-mapping.dmp
-
memory/5960-258-0x0000000000000000-mapping.dmp
-
memory/5984-308-0x0000000000000000-mapping.dmp
-
memory/5984-309-0x0000000000810000-0x000000000081C000-memory.dmpFilesize
48KB
-
memory/6020-260-0x0000000000000000-mapping.dmp