Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03-10-2022 08:28
Static task
static1
Behavioral task
behavioral1
Sample
ecf9ce345d03547056b276e7b45af498210ca29a5895e2a19af4710ad072d3ac.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ecf9ce345d03547056b276e7b45af498210ca29a5895e2a19af4710ad072d3ac.exe
Resource
win10v2004-20220812-en
General
-
Target
ecf9ce345d03547056b276e7b45af498210ca29a5895e2a19af4710ad072d3ac.exe
-
Size
289KB
-
MD5
5725a7142c9aae016bf49d3a827a5d97
-
SHA1
16b86d45da91715d65035ad968fec0b9074c3e7e
-
SHA256
ecf9ce345d03547056b276e7b45af498210ca29a5895e2a19af4710ad072d3ac
-
SHA512
55abe0ee5fab60c98f26c5ffa9b81e11c9c52e5cc35358d470fbb0fc852c5c696ed8103e9a3f1d913791a82f527ed0332a6a072775b8ca48b54f0052c3feb1e5
-
SSDEEP
6144:t/0uo5P7yKRUWNjNhCHM1S9K/LdC+aAP7Y4:tJCfUa4H2Sy9zF
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
white.exepid process 3036 white.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
ecf9ce345d03547056b276e7b45af498210ca29a5895e2a19af4710ad072d3ac.exemsedge.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ecf9ce345d03547056b276e7b45af498210ca29a5895e2a19af4710ad072d3ac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" ecf9ce345d03547056b276e7b45af498210ca29a5895e2a19af4710ad072d3ac.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Drops file in Program Files directory 2 IoCs
Processes:
setup.exedescription ioc process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\238637f2-678c-4945-ad3b-e7db77b3c051.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221004203727.pma setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exepid process 4520 msedge.exe 4520 msedge.exe 4224 msedge.exe 4224 msedge.exe 5112 identity_helper.exe 5112 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedge.exepid process 4224 msedge.exe 4224 msedge.exe 4224 msedge.exe 4224 msedge.exe 4224 msedge.exe 4224 msedge.exe 4224 msedge.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
msedge.exepid process 4224 msedge.exe 4224 msedge.exe 4224 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
ecf9ce345d03547056b276e7b45af498210ca29a5895e2a19af4710ad072d3ac.exewhite.exemsedge.exedescription pid process target process PID 1780 wrote to memory of 3036 1780 ecf9ce345d03547056b276e7b45af498210ca29a5895e2a19af4710ad072d3ac.exe white.exe PID 1780 wrote to memory of 3036 1780 ecf9ce345d03547056b276e7b45af498210ca29a5895e2a19af4710ad072d3ac.exe white.exe PID 1780 wrote to memory of 3036 1780 ecf9ce345d03547056b276e7b45af498210ca29a5895e2a19af4710ad072d3ac.exe white.exe PID 3036 wrote to memory of 4224 3036 white.exe msedge.exe PID 3036 wrote to memory of 4224 3036 white.exe msedge.exe PID 4224 wrote to memory of 4268 4224 msedge.exe msedge.exe PID 4224 wrote to memory of 4268 4224 msedge.exe msedge.exe PID 4224 wrote to memory of 4640 4224 msedge.exe msedge.exe PID 4224 wrote to memory of 4640 4224 msedge.exe msedge.exe PID 4224 wrote to memory of 4640 4224 msedge.exe msedge.exe PID 4224 wrote to memory of 4640 4224 msedge.exe msedge.exe PID 4224 wrote to memory of 4640 4224 msedge.exe msedge.exe PID 4224 wrote to memory of 4640 4224 msedge.exe msedge.exe PID 4224 wrote to memory of 4640 4224 msedge.exe msedge.exe PID 4224 wrote to memory of 4640 4224 msedge.exe msedge.exe PID 4224 wrote to memory of 4640 4224 msedge.exe msedge.exe PID 4224 wrote to memory of 4640 4224 msedge.exe msedge.exe PID 4224 wrote to memory of 4640 4224 msedge.exe msedge.exe PID 4224 wrote to memory of 4640 4224 msedge.exe msedge.exe PID 4224 wrote to memory of 4640 4224 msedge.exe msedge.exe PID 4224 wrote to memory of 4640 4224 msedge.exe msedge.exe PID 4224 wrote to memory of 4640 4224 msedge.exe msedge.exe PID 4224 wrote to memory of 4640 4224 msedge.exe msedge.exe PID 4224 wrote to memory of 4640 4224 msedge.exe msedge.exe PID 4224 wrote to memory of 4640 4224 msedge.exe msedge.exe PID 4224 wrote to memory of 4640 4224 msedge.exe msedge.exe PID 4224 wrote to memory of 4640 4224 msedge.exe msedge.exe PID 4224 wrote to memory of 4640 4224 msedge.exe msedge.exe PID 4224 wrote to memory of 4640 4224 msedge.exe msedge.exe PID 4224 wrote to memory of 4640 4224 msedge.exe msedge.exe PID 4224 wrote to memory of 4640 4224 msedge.exe msedge.exe PID 4224 wrote to memory of 4640 4224 msedge.exe msedge.exe PID 4224 wrote to memory of 4640 4224 msedge.exe msedge.exe PID 4224 wrote to memory of 4640 4224 msedge.exe msedge.exe PID 4224 wrote to memory of 4640 4224 msedge.exe msedge.exe PID 4224 wrote to memory of 4640 4224 msedge.exe msedge.exe PID 4224 wrote to memory of 4640 4224 msedge.exe msedge.exe PID 4224 wrote to memory of 4640 4224 msedge.exe msedge.exe PID 4224 wrote to memory of 4640 4224 msedge.exe msedge.exe PID 4224 wrote to memory of 4640 4224 msedge.exe msedge.exe PID 4224 wrote to memory of 4640 4224 msedge.exe msedge.exe PID 4224 wrote to memory of 4640 4224 msedge.exe msedge.exe PID 4224 wrote to memory of 4640 4224 msedge.exe msedge.exe PID 4224 wrote to memory of 4640 4224 msedge.exe msedge.exe PID 4224 wrote to memory of 4640 4224 msedge.exe msedge.exe PID 4224 wrote to memory of 4640 4224 msedge.exe msedge.exe PID 4224 wrote to memory of 4640 4224 msedge.exe msedge.exe PID 4224 wrote to memory of 4520 4224 msedge.exe msedge.exe PID 4224 wrote to memory of 4520 4224 msedge.exe msedge.exe PID 4224 wrote to memory of 1988 4224 msedge.exe msedge.exe PID 4224 wrote to memory of 1988 4224 msedge.exe msedge.exe PID 4224 wrote to memory of 1988 4224 msedge.exe msedge.exe PID 4224 wrote to memory of 1988 4224 msedge.exe msedge.exe PID 4224 wrote to memory of 1988 4224 msedge.exe msedge.exe PID 4224 wrote to memory of 1988 4224 msedge.exe msedge.exe PID 4224 wrote to memory of 1988 4224 msedge.exe msedge.exe PID 4224 wrote to memory of 1988 4224 msedge.exe msedge.exe PID 4224 wrote to memory of 1988 4224 msedge.exe msedge.exe PID 4224 wrote to memory of 1988 4224 msedge.exe msedge.exe PID 4224 wrote to memory of 1988 4224 msedge.exe msedge.exe PID 4224 wrote to memory of 1988 4224 msedge.exe msedge.exe PID 4224 wrote to memory of 1988 4224 msedge.exe msedge.exe PID 4224 wrote to memory of 1988 4224 msedge.exe msedge.exe PID 4224 wrote to memory of 1988 4224 msedge.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ecf9ce345d03547056b276e7b45af498210ca29a5895e2a19af4710ad072d3ac.exe"C:\Users\Admin\AppData\Local\Temp\ecf9ce345d03547056b276e7b45af498210ca29a5895e2a19af4710ad072d3ac.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\white.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\white.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=white.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.03⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffd8ac246f8,0x7ffd8ac24708,0x7ffd8ac247184⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,1916011419887315475,2361099108854498851,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:24⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,1916011419887315475,2361099108854498851,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:34⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,1916011419887315475,2361099108854498851,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,1916011419887315475,2361099108854498851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,1916011419887315475,2361099108854498851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2180,1916011419887315475,2361099108854498851,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4936 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,1916011419887315475,2361099108854498851,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2180,1916011419887315475,2361099108854498851,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5688 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,1916011419887315475,2361099108854498851,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,1916011419887315475,2361099108854498851,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,1916011419887315475,2361099108854498851,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,1916011419887315475,2361099108854498851,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6264 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,1916011419887315475,2361099108854498851,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5744 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings4⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff7860a5460,0x7ff7860a5470,0x7ff7860a54805⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,1916011419887315475,2361099108854498851,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5744 /prefetch:84⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2180,1916011419887315475,2361099108854498851,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5160 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2180,1916011419887315475,2361099108854498851,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5176 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2180,1916011419887315475,2361099108854498851,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5140 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,1916011419887315475,2361099108854498851,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2708 /prefetch:24⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=white.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.03⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x14c,0x170,0x7ffd8ac246f8,0x7ffd8ac24708,0x7ffd8ac247184⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD58be9513fd38b94d4f6b5011b68b60326
SHA147feef421fe8de09e36ca685e9cf19d404aa8917
SHA2565bf3203e8be948e62917ebab13e1b21aec105c473089b233874fac8e5748bb2d
SHA512cb3dbfa46f3ee28956deab38fefa8276f9efa6ea978ff6b7f810f7f9ba106ed569f017cf5c840ae90fc5f83a1e6dbe50efef8e3412f4f38452a00915b2cc58bc
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\white.exeFilesize
344KB
MD5b03b6280347d6f51a16cbf0930fee1bc
SHA1ae90d123447132223332890f79f7c7dc60020716
SHA2564c46b20b0a3d0fa22fa058e6becc05ec2b3179a1e90e8f674fb1b0195397b18d
SHA5123086aca14963b45728403d9412f73f3e59e51eb56038e427519d70cec7d7881e822352802844dffccb6500b32e0e49abf86a0718e7811b40b17c02cf11ac4cc0
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\white.exeFilesize
344KB
MD5b03b6280347d6f51a16cbf0930fee1bc
SHA1ae90d123447132223332890f79f7c7dc60020716
SHA2564c46b20b0a3d0fa22fa058e6becc05ec2b3179a1e90e8f674fb1b0195397b18d
SHA5123086aca14963b45728403d9412f73f3e59e51eb56038e427519d70cec7d7881e822352802844dffccb6500b32e0e49abf86a0718e7811b40b17c02cf11ac4cc0
-
\??\pipe\LOCAL\crashpad_4224_FKGJQBHFVMZUVDQAMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1072-161-0x0000000000000000-mapping.dmp
-
memory/1220-169-0x0000000000000000-mapping.dmp
-
memory/1272-170-0x0000000000000000-mapping.dmp
-
memory/1284-178-0x0000000000000000-mapping.dmp
-
memory/1988-145-0x0000000000000000-mapping.dmp
-
memory/2632-158-0x0000000000000000-mapping.dmp
-
memory/3036-136-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/3036-137-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/3036-135-0x00000000004B0000-0x00000000004ED000-memory.dmpFilesize
244KB
-
memory/3036-162-0x00000000004B0000-0x00000000004ED000-memory.dmpFilesize
244KB
-
memory/3036-152-0x00000000004B0000-0x00000000004ED000-memory.dmpFilesize
244KB
-
memory/3036-132-0x0000000000000000-mapping.dmp
-
memory/3104-154-0x0000000000000000-mapping.dmp
-
memory/3176-147-0x0000000000000000-mapping.dmp
-
memory/3356-166-0x0000000000000000-mapping.dmp
-
memory/3464-156-0x0000000000000000-mapping.dmp
-
memory/3532-151-0x0000000000000000-mapping.dmp
-
memory/3612-149-0x0000000000000000-mapping.dmp
-
memory/3908-160-0x0000000000000000-mapping.dmp
-
memory/4224-138-0x0000000000000000-mapping.dmp
-
memory/4268-139-0x0000000000000000-mapping.dmp
-
memory/4284-175-0x0000000000000000-mapping.dmp
-
memory/4316-163-0x0000000000000000-mapping.dmp
-
memory/4316-173-0x0000000000000000-mapping.dmp
-
memory/4324-177-0x0000000000000000-mapping.dmp
-
memory/4520-142-0x0000000000000000-mapping.dmp
-
memory/4612-168-0x0000000000000000-mapping.dmp
-
memory/4640-141-0x0000000000000000-mapping.dmp
-
memory/5112-171-0x0000000000000000-mapping.dmp