neshta | 119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a

Analysis

max time kernel
175s
max time network
200s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 02:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
Size

191KB
MD5

47a51f3d6e697dbb17364ba2de7bb710
SHA1

f730dcc243f31c338fd815e208fd2adbf313e009
SHA256

119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a
SHA512

8f4b133874499706f8d5e360201a3eae43eafacfea0c9c253fcc8d07d904c47617c07e354db90fcc67ec2c05b80b4f3c51f3eaa121272f70f8e52bfc1fa135b2
SSDEEP

1536:JxqjQ+P04wsmJCxgWY54vNd+4tNfuebnwZJ/roM7ZJfUQWd:sr85CSWOrgNfLbwTEM78N

Score

10^/10

neshta evasion persistence spyware stealer

Malware Config

Signatures

Detect Neshta payload 26 IoCs

Processes:

resource	yara_rule
C:\Windows\svchost.com	family_neshta
C:\Windows\svchost.com	family_neshta
C:\Windows\svchost.com	family_neshta
C:\odt\OFFICE~1.EXE	family_neshta
C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe	family_neshta
C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe	family_neshta
C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE	family_neshta
C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE	family_neshta
C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE	family_neshta
C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE	family_neshta
C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE	family_neshta
C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE	family_neshta
C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE	family_neshta
C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE	family_neshta
C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~3.EXE	family_neshta
C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	family_neshta
C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	family_neshta
C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	family_neshta
C:\Users\Admin\AppData\Local\MICROS~1\OneDrive\181510~1.001\FILESY~1.EXE	family_neshta
C:\Users\ALLUSE~1\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	family_neshta
C:\Users\ALLUSE~1\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	family_neshta
C:\Users\ALLUSE~1\PACKAG~1\{CA675~1\VCREDI~1.EXE	family_neshta
C:\Users\ALLUSE~1\PACKAG~1\{61087~1\VCREDI~1.EXE	family_neshta
C:\Users\ALLUSE~1\PACKAG~1\{57A73~1\VC_RED~1.EXE	family_neshta
C:\Users\ALLUSE~1\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	family_neshta
C:\Users\ALLUSE~1\PACKAG~1\{33D1F~1\VCREDI~1.EXE	family_neshta

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe

Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exemsng.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	msng.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Executes dropped EXE 4 IoCs

Processes:

119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exesvchost.comsvchost.commsng.exe

pid process

5040 119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
4328 svchost.com
3640 svchost.com
4416 msng.exe

pid	process
5040	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
4328	svchost.com
3640	svchost.com
4416	msng.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exemsng.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\msng = "C:\\Windows\\system32\\msng.exe"	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	msng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\msng = "C:\\Windows\\system32\\msng.exe"	msng.exe

Enumerates connected drives 3 TTPs 3 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

msng.exe

description ioc process

File opened (read-only) \??\a: msng.exe
File opened (read-only) \??\b: msng.exe
File opened (read-only) \??\e: msng.exe

description	ioc	process
File opened (read-only)	\??\a:	msng.exe
File opened (read-only)	\??\b:	msng.exe
File opened (read-only)	\??\e:	msng.exe

Drops file in System32 directory 7 IoCs

Processes:

119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exemsng.exe

description	ioc	process
File created	C:\Windows\SysWOW64\msng.exe	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\Windows\SysWOW64\msng.exe	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File created	C:\Windows\SysWOW64\rundII32.exe	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File created	C:\Windows\SysWOW64\rundll32.exe	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File created	C:\Windows\SysWOW64\rundII32.exe	msng.exe
File opened for modification	C:\Windows\SysWOW64\rundII32.exe	msng.exe
File created	C:\Windows\SysWOW64\rundll32.exe	msng.exe

Drops file in Program Files directory 64 IoCs

Processes:

119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exesvchost.com

description	ioc	process
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	svchost.com
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MIA062~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13165~1.21\MICROS~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	svchost.com
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MIA062~1.EXE	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpshare.exe	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	svchost.com
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~2.EXE	svchost.com
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	svchost.com
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~4.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~2.EXE	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmlaunch.exe	svchost.com
File opened for modification	C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	svchost.com
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE	svchost.com
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmprph.exe	svchost.com
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmplayer.exe	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	svchost.com
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13165~1.21\MICROS~1.EXE	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe	svchost.com
File opened for modification	C:\PROGRA~2\WINDOW~4\wmprph.exe	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE	svchost.com

Drops file in Windows directory 5 IoCs

Processes:

svchost.comsvchost.com119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe

description	ioc	process
File opened for modification	C:\Windows\svchost.com	svchost.com
File opened for modification	C:\Windows\svchost.com	svchost.com
File opened for modification	C:\Windows\svchost.com	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\directx.sys	svchost.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe

Modifies registry class 42 IoCs

Processes:

explorer.exemsedge.exe119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0 = 5a003100000000007a55bc801000333538322d3439300000420009000400efbe7a55b5807a55bc802e0000000e2e020000000900000000000000000000000000000003f63c0033003500380032002d00340039003000000018000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 50003100000000000c5526a110004c6f63616c003c0009000400efbe0c5519997a55b6802e00000095e101000000010000000000000000000000000000004e3d50004c006f00630061006c00000014000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 56003100000000000c55199912004170704461746100400009000400efbe0c5519997a55b6802e00000082e10100000001000000000000000000000000000000bc3d97004100700070004400610074006100000016000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 4e003100000000007a55b580100054656d7000003a0009000400efbe0c5519997a55b5802e00000096e10100000001000000000000000000000000000000bac50e01540065006d007000000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\0 = ca003100000000007a55bc8010003131394638397e310000b20009000400efbe7a55bc807a55bc802e000000132e020000000700000000000000000000000000000003f63c003100310039006600380039003900320037003800370031003800640030003900340038003200360033006400300034003900610031003200660036003500610036003000370064006400620033006600310032003800350033003500650034003200350038003400650033006100300032003400640037003200660036006100000018000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\0\MRUListEx = ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 50003100000000000c5590a1100041646d696e003c0009000400efbe0c5519997a55b6802e00000077e10100000001000000000000000000000000000000f5ed3500410064006d0069006e00000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 78003100000000000c5519991100557365727300640009000400efbe874f77487a55b5802e000000c70500000000010000000000000000003a00000000008714af0055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\0\NodeSlot = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msng.exemsedge.exe

pid	process
4416	msng.exe
4416	msng.exe
4416	msng.exe
4416	msng.exe
4416	msng.exe
4416	msng.exe
4416	msng.exe
4416	msng.exe
4416	msng.exe
4416	msng.exe
4416	msng.exe
4416	msng.exe
4416	msng.exe
4416	msng.exe
4416	msng.exe
4416	msng.exe
4416	msng.exe
4416	msng.exe
4416	msng.exe
4416	msng.exe
4416	msng.exe
4416	msng.exe
4416	msng.exe
4416	msng.exe
4416	msng.exe
4416	msng.exe
4416	msng.exe
4416	msng.exe
4416	msng.exe
4416	msng.exe
4416	msng.exe
4416	msng.exe
4416	msng.exe
4416	msng.exe
4416	msng.exe
4416	msng.exe
4416	msng.exe
4416	msng.exe
4416	msng.exe
4416	msng.exe
4416	msng.exe
4416	msng.exe
4416	msng.exe
4416	msng.exe
4324	msedge.exe
4324	msedge.exe
4416	msng.exe
4416	msng.exe
4416	msng.exe
4416	msng.exe
4416	msng.exe
4416	msng.exe
4416	msng.exe
4416	msng.exe
4416	msng.exe
4416	msng.exe
4416	msng.exe
4416	msng.exe
4416	msng.exe
4416	msng.exe
4416	msng.exe
4416	msng.exe
4416	msng.exe
4416	msng.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

msng.exe

pid process

4416 msng.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

Processes:

msedge.exe

pid process

2208 msedge.exe
2208 msedge.exe
2208 msedge.exe
2208 msedge.exe
2208 msedge.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msedge.exe

pid process

2208 msedge.exe
2208 msedge.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exemsng.exeexplorer.exe

pid process

5040 119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
4416 msng.exe
3212 explorer.exe
3212 explorer.exe

pid	process
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe

pid	process
2208	msedge.exe
2208	msedge.exe

pid	process
5040	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
4416	msng.exe
3212	explorer.exe
3212	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exesvchost.comsvchost.commsng.exeexplorer.exemsedge.exe

description	pid	process	target process
PID 4332 wrote to memory of 5040	4332	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
PID 4332 wrote to memory of 5040	4332	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
PID 4332 wrote to memory of 5040	4332	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
PID 5040 wrote to memory of 4328	5040	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe	svchost.com
PID 5040 wrote to memory of 4328	5040	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe	svchost.com
PID 5040 wrote to memory of 4328	5040	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe	svchost.com
PID 5040 wrote to memory of 3640	5040	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe	svchost.com
PID 5040 wrote to memory of 3640	5040	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe	svchost.com
PID 5040 wrote to memory of 3640	5040	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe	svchost.com
PID 4328 wrote to memory of 4284	4328	svchost.com	explorer.exe
PID 4328 wrote to memory of 4284	4328	svchost.com	explorer.exe
PID 4328 wrote to memory of 4284	4328	svchost.com	explorer.exe
PID 3640 wrote to memory of 4416	3640	svchost.com	msng.exe
PID 3640 wrote to memory of 4416	3640	svchost.com	msng.exe
PID 3640 wrote to memory of 4416	3640	svchost.com	msng.exe
PID 4416 wrote to memory of 3472	4416	msng.exe	explorer.exe
PID 4416 wrote to memory of 3472	4416	msng.exe	explorer.exe
PID 4416 wrote to memory of 3472	4416	msng.exe	explorer.exe
PID 5084 wrote to memory of 2208	5084	explorer.exe	msedge.exe
PID 5084 wrote to memory of 2208	5084	explorer.exe	msedge.exe
PID 2208 wrote to memory of 4752	2208	msedge.exe	msedge.exe
PID 2208 wrote to memory of 4752	2208	msedge.exe	msedge.exe
PID 2208 wrote to memory of 1032	2208	msedge.exe	msedge.exe
PID 2208 wrote to memory of 1032	2208	msedge.exe	msedge.exe
PID 2208 wrote to memory of 1032	2208	msedge.exe	msedge.exe
PID 2208 wrote to memory of 1032	2208	msedge.exe	msedge.exe
PID 2208 wrote to memory of 1032	2208	msedge.exe	msedge.exe
PID 2208 wrote to memory of 1032	2208	msedge.exe	msedge.exe
PID 2208 wrote to memory of 1032	2208	msedge.exe	msedge.exe
PID 2208 wrote to memory of 1032	2208	msedge.exe	msedge.exe
PID 2208 wrote to memory of 1032	2208	msedge.exe	msedge.exe
PID 2208 wrote to memory of 1032	2208	msedge.exe	msedge.exe
PID 2208 wrote to memory of 1032	2208	msedge.exe	msedge.exe
PID 2208 wrote to memory of 1032	2208	msedge.exe	msedge.exe
PID 2208 wrote to memory of 1032	2208	msedge.exe	msedge.exe
PID 2208 wrote to memory of 1032	2208	msedge.exe	msedge.exe
PID 2208 wrote to memory of 1032	2208	msedge.exe	msedge.exe
PID 2208 wrote to memory of 1032	2208	msedge.exe	msedge.exe
PID 2208 wrote to memory of 1032	2208	msedge.exe	msedge.exe
PID 2208 wrote to memory of 1032	2208	msedge.exe	msedge.exe
PID 2208 wrote to memory of 1032	2208	msedge.exe	msedge.exe
PID 2208 wrote to memory of 1032	2208	msedge.exe	msedge.exe
PID 2208 wrote to memory of 1032	2208	msedge.exe	msedge.exe
PID 2208 wrote to memory of 1032	2208	msedge.exe	msedge.exe
PID 2208 wrote to memory of 1032	2208	msedge.exe	msedge.exe
PID 2208 wrote to memory of 1032	2208	msedge.exe	msedge.exe
PID 2208 wrote to memory of 1032	2208	msedge.exe	msedge.exe
PID 2208 wrote to memory of 1032	2208	msedge.exe	msedge.exe
PID 2208 wrote to memory of 1032	2208	msedge.exe	msedge.exe
PID 2208 wrote to memory of 1032	2208	msedge.exe	msedge.exe
PID 2208 wrote to memory of 1032	2208	msedge.exe	msedge.exe
PID 2208 wrote to memory of 1032	2208	msedge.exe	msedge.exe
PID 2208 wrote to memory of 1032	2208	msedge.exe	msedge.exe
PID 2208 wrote to memory of 1032	2208	msedge.exe	msedge.exe
PID 2208 wrote to memory of 1032	2208	msedge.exe	msedge.exe
PID 2208 wrote to memory of 1032	2208	msedge.exe	msedge.exe
PID 2208 wrote to memory of 1032	2208	msedge.exe	msedge.exe
PID 2208 wrote to memory of 1032	2208	msedge.exe	msedge.exe
PID 2208 wrote to memory of 1032	2208	msedge.exe	msedge.exe
PID 2208 wrote to memory of 1032	2208	msedge.exe	msedge.exe
PID 2208 wrote to memory of 1032	2208	msedge.exe	msedge.exe
PID 2208 wrote to memory of 1032	2208	msedge.exe	msedge.exe
PID 2208 wrote to memory of 4324	2208	msedge.exe	msedge.exe
PID 2208 wrote to memory of 4324	2208	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
"C:\Users\Admin\AppData\Local\Temp\119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe"
1⤵
- Modifies system executable filetype association
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4332

C:\Users\Admin\AppData\Local\Temp\3582-490\119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe"
2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5040

C:\Windows\svchost.com
"C:\Windows\svchost.com" "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Local\Temp\3582-490\119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a
3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4328

C:\Windows\SysWOW64\explorer.exe
C:\Windows\System32\explorer.exe C:\Users\Admin\AppData\Local\Temp\3582-490\119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a
4⤵
PID:4284

C:\Windows\svchost.com
"C:\Windows\svchost.com" "C:\Windows\system32\msng.exe" fuckystart
3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3640

C:\Windows\SysWOW64\msng.exe
C:\Windows\system32\msng.exe fuckystart
4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4416

C:\Windows\SysWOW64\explorer.exe
explorer.exe http://www.OpenClose.ir
5⤵
PID:3472

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3212

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:5084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.openclose.ir/
2⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8342446f8,0x7ff834244708,0x7ff834244718
3⤵
PID:4752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,12571060935115180721,13997246822608992463,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
3⤵
PID:1032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,12571060935115180721,13997246822608992463,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2444 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,12571060935115180721,13997246822608992463,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
3⤵
PID:380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,12571060935115180721,13997246822608992463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
3⤵
PID:3480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,12571060935115180721,13997246822608992463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3792 /prefetch:1
3⤵
PID:1808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,12571060935115180721,13997246822608992463,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
3⤵
PID:4060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,12571060935115180721,13997246822608992463,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
3⤵
PID:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2084,12571060935115180721,13997246822608992463,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3956 /prefetch:8
3⤵
PID:3552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,12571060935115180721,13997246822608992463,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6192 /prefetch:1
3⤵
PID:4880

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1832

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Hidden Files and Directories

T1158

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe
Filesize
942KB

MD5
2d3cc5612a414f556f925a3c1cb6a1d6

SHA1
0fee45317280ed326e941cc2d0df848c4e74e894

SHA256
fe46de1265b6fe2e316aca33d7f7f45c6ffdf7c49a044b464fd9dc88ec92091b

SHA512
cc49b200adf92a915da6f9b73417543d4dcc77414e0c4bd2ce3bfdfc5d151e0b28249f8d64f6b7087cf8c3bab6aeeab5b152ac6199cb7cc63e64a66b4f03a9f5

Download Submit
C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe
Filesize
623KB

MD5
6e84b6096aaa18cabc30f1122d5af449

SHA1
e6729edd11b52055b5e34d39e5f3b8f071bbac4f

SHA256
c6b7f9119cf867951f007c5468f75eb4dca59c7eedeb0afdd8ad9d5b9606e759

SHA512
af5b33e7e190587bb152adf65fbcd4c1cd521f638863a6d1c7de29599cce6439b6c7b653180661cb0382007aefa0ae5a1b1b841eaaa116ce715f3a5ba0725a42

Download Submit
C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE
Filesize
217KB

MD5
ad0efa1df844814c2e8ddc188cb0e3b5

SHA1
b1a8a09f2223aab8b8e3e9bc0e58cc83d402f8ab

SHA256
c87fd5b223cb6dc716815b442b4964d4670a30b5c79f4fb9f1c3a65ec9072e5a

SHA512
532cc173d9ef27098ff10b6b652c64231b4a14f99df3b5de2eb1423370c19590e2a6032023d3ed02e2080f2f087b620ebbbd079e4a47a584ef11f3eaa0eb8520

Download Submit
C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE
Filesize
138KB

MD5
fafb18b930b2b05ac8c5ddb988e9062f

SHA1
825ea5069601fb875f8d050aa01300eac03d3826

SHA256
c17785fe7e6b5e08fe5a4ca3679fee85ba6f2e5efcce0fb9807727cf8aa25265

SHA512
be034e7377bd27092aad02e13a152fb80ff74c1ba2fb63ccb344cd55315d115ee47e46727cbe55ca808efafa58d7924e3eed965e9a2fd3b9ae2dff7834383e54

Download Submit
C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE
Filesize
366KB

MD5
9e63bd6a4360beabbc82ed4a2f03522e

SHA1
10961b7873ce3b99939ab5abd634b0f771dc6436

SHA256
c8f05c107ecdc905dd2b3c708c40eb50118a65d497e12df6958ce5e1a53af108

SHA512
ae72061d3c198cdd9dd4eb17651b6532f3d6016651d943ae23c82d11d1b8b8c86679f0d516d1050f258e445edd7447019fbdb24d897bb919807ff8c449e04925

Download Submit
C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~3.EXE
Filesize
285KB

MD5
fab69bd8ce4878fe7db435f8708d8aa5

SHA1
5f57a48b198161d84a8b64b3611b5250bec2d818

SHA256
171ee72970045068e62105231ae2dba43b7e8e6ad52c69703152c61747aa702f

SHA512
8fdc5c5b0fa585484816537cdd5e6406204e899f8bfbb1e86ef38b001233145e7d64299a7f1c34a5485b44e04abbedce56380409b4e0c3e0385f3db9fefd0d26

Download Submit
C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE
Filesize
1.1MB

MD5
6088771ce98d1dd4c4f3b70291c7ef39

SHA1
09f041bf16a84d2214a75672d2eb7e982b68f0c2

SHA256
9300eae88b3af629d2041145c0b9692ae7d8ac0ba1d4fa626084c02ec9adb1cc

SHA512
e1470ae4ad68f95655ba55c0ae578c46f030e2e627eff44f42934119ddff6ce2f58afbd4b7fc9a94086d954f1a053ae3b520758e1a536c0e823da7882a9dba14

Download Submit
C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE
Filesize
1.1MB

MD5
a5d9eaa7d52bffc494a5f58203c6c1b5

SHA1
97928ba7b61b46a1a77a38445679d040ffca7cc8

SHA256
34b8662d38e7d3d6394fa6c965d943d2c82ea06ba9d7a0af4f8e0571fb5a9c48

SHA512
b6fdc8389bb4d736d608600469be6a4b0452aa3ea082f9a0791022a14c02b8fb7dcd62df133b0518e91283094eaba2be9318316f72d2c4aae6286d3e8686e787

Download Submit
C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE
Filesize
1.3MB

MD5
27543bab17420af611ccc3029db9465a

SHA1
f0f96fd53f9695737a3fa6145bc5a6ce58227966

SHA256
75530dc732f35cc796d19edd11ae6d6f6ef6499ddcf2e57307582b1c5299554c

SHA512
a62c2dd60e1df309ec1bb48ea85184914962ba83766f29d878569549ca20fca68f304f4494702d9e5f09adedc2166e48ee0bc1f4a5d9e245c5490daf15036bea

Download Submit
C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE
Filesize
1.1MB

MD5
a5d9eaa7d52bffc494a5f58203c6c1b5

SHA1
97928ba7b61b46a1a77a38445679d040ffca7cc8

SHA256
34b8662d38e7d3d6394fa6c965d943d2c82ea06ba9d7a0af4f8e0571fb5a9c48

SHA512
b6fdc8389bb4d736d608600469be6a4b0452aa3ea082f9a0791022a14c02b8fb7dcd62df133b0518e91283094eaba2be9318316f72d2c4aae6286d3e8686e787

Download Submit
C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE
Filesize
1.1MB

MD5
5c78384d8eb1f6cb8cb23d515cfe7c98

SHA1
b732ab6c3fbf2ded8a4d6c8962554d119f59082e

SHA256
9abd7f0aa942ee6b263cdc4b32a4110ddb95e43ad411190f0ea48c0064884564

SHA512
99324af5f8fb70a9d01f97d845a4c6999053d6567ba5b80830a843a1634b02eaf3c0c04ced924cf1b1be9b4d1dbbcb95538385f7f85ad84d3eaaa6dcdebcc8a6

Download Submit
C:\PROGRA~2\MOZILL~1\UNINST~1.EXE
Filesize
129KB

MD5
e7d2d4bedb99f13e7be8338171e56dbf

SHA1
8dafd75ae2c13d99e5ef8c0e9362a445536c31b5

SHA256
c8ef54853df3a3b64aa4b1ecfb91615d616c7ff998589e5a3434118611ad2a24

SHA512
2017dea799cc03b02a17e3616fb6fbe8c86ab2450b1aaf147fce1e67cc472ded12befd686d395386ffdaa992145996eb421d61d3a922cea45e94ac40eef76adc

Download Submit
C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe
Filesize
494KB

MD5
05bdfd8a3128ab14d96818f43ebe9c0e

SHA1
495cbbd020391e05d11c52aa23bdae7b89532eb7

SHA256
7b945c7e6b8bfbb489f003ecd1d0dcd4803042003de4646d4206114361a0fbbb

SHA512
8d9b9fc407986bd53fe3b56c96b7371cc782b4bac705253bfb0a2b0b1e6883fdb022f1ac87b8bfd7005291991b6a3dfbaceab54f5d494e0af70f0435a0b8b0da

Download Submit
C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE
Filesize
536KB

MD5
bcb5db16e576464d3d8d93e1907bf946

SHA1
b10f3c3dc4baef4655ae2c30543be9d3c40b9781

SHA256
24c9b3b4cf5e45a56c90d7fd112b05f07dd89cf96e98729beb2f6081fca758c0

SHA512
c36339b06a00938c8a63ba4d54a766dc3ca3d1e34d69e9b4b2bfa9ca79c5c65d07f216f84af2b60be0c9cbdccadc5c271018efed52def8bd778dc01743d61229

Download Submit
C:\Users\ALLUSE~1\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE
Filesize
6.7MB

MD5
63dc05e27a0b43bf25f151751b481b8c

SHA1
b20321483dac62bce0aa0cef1d193d247747e189

SHA256
7d607fb69c69a72a5bf4305599279f46318312ce1082b6a34ac9100b8c7762ce

SHA512
374d705704d456cc5f9f79b7f465f6ec7c775dc43001c840e9d6efbbdef20926ed1fa97f8a9b1e73161e17f72520b96c05fa58ac86b3945208b405f9166e7ba3

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{33D1F~1\VCREDI~1.EXE
Filesize
485KB

MD5
86749cd13537a694795be5d87ef7106d

SHA1
538030845680a8be8219618daee29e368dc1e06c

SHA256
8c35dcc975a5c7c687686a3970306452476d17a89787bc5bd3bf21b9de0d36a5

SHA512
7b6ae20515fb6b13701df422cbb0844d26c8a98087b2758427781f0bf11eb9ec5da029096e42960bf99ddd3d4f817db6e29ac172039110df6ea92547d331db4c

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{4D8DC~1\VC_RED~1.EXE
Filesize
714KB

MD5
24179b4581907abfef8a55ab41c97999

SHA1
e4de417476f43da4405f4340ebf6044f6b094337

SHA256
a8b960bcbf3045bedd2f6b59c521837ac4aee9c566001c01d8fc43b15b1dfdc7

SHA512
6fb0621ea3755db8af58d86bdc4f5324ba0832790e83375d07c378b6f569a109e14a78ed7d1a5e105b7a005194a31bd7771f3008b2026a0938d695e62f6ea6b8

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{57A73~1\VC_RED~1.EXE
Filesize
674KB

MD5
9c10a5ec52c145d340df7eafdb69c478

SHA1
57f3d99e41d123ad5f185fc21454367a7285db42

SHA256
ccf37e88447a7afdb0ba4351b8c5606dbb05b984fb133194d71bcc00d7be4e36

SHA512
2704cfd1a708bfca6db7c52467d3abf0b09313db0cdd1ea8e5d48504c8240c4bf24e677f17c5df9e3ac1f6a678e0328e73e951dc4481f35027cb03b2966dc38f

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{61087~1\VCREDI~1.EXE
Filesize
536KB

MD5
bcb5db16e576464d3d8d93e1907bf946

SHA1
b10f3c3dc4baef4655ae2c30543be9d3c40b9781

SHA256
24c9b3b4cf5e45a56c90d7fd112b05f07dd89cf96e98729beb2f6081fca758c0

SHA512
c36339b06a00938c8a63ba4d54a766dc3ca3d1e34d69e9b4b2bfa9ca79c5c65d07f216f84af2b60be0c9cbdccadc5c271018efed52def8bd778dc01743d61229

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{CA675~1\VCREDI~1.EXE
Filesize
525KB

MD5
a55d2c94c27ffe098171e6c1f296f56d

SHA1
d0c875b2721894404c9eaa07d444c0637a3cbc3b

SHA256
e81e4630b01d181fb3116e9e874eedfe1a43472bfa6d83cc24f55e78721ddf86

SHA512
13ee9041b21d4e00392aeaa5440c34301f945d9bbd4f07f831397040991eee79842a5618c1fd26ec75e7132b5da811bc9605b76b83a48355ede37a2a1c1cd6f0

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{EF6B0~1\VCREDI~1.EXE
Filesize
536KB

MD5
91490c78c45cbd686ac759b6a252e898

SHA1
51bb6c5aa14cf478b0b6fa0329c7366d1f6fb480

SHA256
47f3331b4f35012d38bc11cdeae0ff7b4ae1186d4e916e3e48a9440438296821

SHA512
f7d44cd6df2c0c492731c14ca27e26605e8cddb9cb9287bf083fe1e43f753cafa11c341f0915510ad1d189466e92bb3f4e219b3599e9df72878bde14518bee35

Download Submit
C:\Users\Admin\AppData\Local\MICROS~1\OneDrive\181510~1.001\FILESY~1.EXE
Filesize
333KB

MD5
74faddfe0e1439ee631fb12a6c7679f5

SHA1
759ac4cd1ba407d31e5951d57a37656f6eb0bad7

SHA256
ac7914efd31353b62d05474b98f6d6f97022475803b41d5f4256f0f13e334066

SHA512
f060c3fc72cb7d282ffbcfb5cd5a6ec8e0cfa013237326288b3ab35bb790fb76e190914f1eda9b632188b1f8efda91b4fae1bd21c719e5bf5f3b237746951e97

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
Filesize
151KB

MD5
47492b8fbb5cf1096ad18e36479ce000

SHA1
a730907ae2f0ed8c8bdc04b4ad9e66aa6f37428f

SHA256
066f4bc94ba6727ab0ca307d7c80b309ebeea596f4dc14f424a0a9b5df10504a

SHA512
3e288a920dda1c7b7ecd9b21a90364e751bf650c12e801f12c38cc18d4a6bee0f005c87c7c13e1631da534cdf6caaeac8ecca2a4038992107700ac0a57bff2d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
Filesize
151KB

MD5
47492b8fbb5cf1096ad18e36479ce000

SHA1
a730907ae2f0ed8c8bdc04b4ad9e66aa6f37428f

SHA256
066f4bc94ba6727ab0ca307d7c80b309ebeea596f4dc14f424a0a9b5df10504a

SHA512
3e288a920dda1c7b7ecd9b21a90364e751bf650c12e801f12c38cc18d4a6bee0f005c87c7c13e1631da534cdf6caaeac8ecca2a4038992107700ac0a57bff2d1

Download Submit
C:\Windows\SysWOW64\msng.exe
Filesize
151KB

MD5
47492b8fbb5cf1096ad18e36479ce000

SHA1
a730907ae2f0ed8c8bdc04b4ad9e66aa6f37428f

SHA256
066f4bc94ba6727ab0ca307d7c80b309ebeea596f4dc14f424a0a9b5df10504a

SHA512
3e288a920dda1c7b7ecd9b21a90364e751bf650c12e801f12c38cc18d4a6bee0f005c87c7c13e1631da534cdf6caaeac8ecca2a4038992107700ac0a57bff2d1

Download Submit
C:\Windows\SysWOW64\msng.exe
Filesize
151KB

MD5
47492b8fbb5cf1096ad18e36479ce000

SHA1
a730907ae2f0ed8c8bdc04b4ad9e66aa6f37428f

SHA256
066f4bc94ba6727ab0ca307d7c80b309ebeea596f4dc14f424a0a9b5df10504a

SHA512
3e288a920dda1c7b7ecd9b21a90364e751bf650c12e801f12c38cc18d4a6bee0f005c87c7c13e1631da534cdf6caaeac8ecca2a4038992107700ac0a57bff2d1

Download Submit
C:\Windows\directx.sys
Filesize
30B

MD5
c442d3b8c7403c6dd7d9f93795276c05

SHA1
bc8f41a5d4adc92875f58081f0256a4c7b614db6

SHA256
e04865623a4f68d752dc73b27e8d38e2418832d1e9df3cdc9936737974e023cc

SHA512
7816d49f07b34032d335e4a6758c76ae9a1ccc8cdac4b7d7792e5e1de5d6c0f9357fc31594ba75a70d8f7605972b45b7225a5d0e91a71d65b8d693950acdac2c

Download Submit
C:\Windows\svchost.com
Filesize
40KB

MD5
045910ccff03704d3f4d4024134e53f5

SHA1
ab9491f710e9f205de2c89bfb14354bbfaee214f

SHA256
8fab4e8f332d274e874047c29edca2bdb76a654da518413a2f7760810096550a

SHA512
7468bb3f77b6d910f0ad6e6e511c2543f02e0fe97de32feef677b73be4d09b8f4f3d15b64168758fc42672b496e17ef038f9b44f88840da9f2ae675787e3e7a3

Download Submit
C:\Windows\svchost.com
Filesize
40KB

MD5
045910ccff03704d3f4d4024134e53f5

SHA1
ab9491f710e9f205de2c89bfb14354bbfaee214f

SHA256
8fab4e8f332d274e874047c29edca2bdb76a654da518413a2f7760810096550a

SHA512
7468bb3f77b6d910f0ad6e6e511c2543f02e0fe97de32feef677b73be4d09b8f4f3d15b64168758fc42672b496e17ef038f9b44f88840da9f2ae675787e3e7a3

Download Submit
C:\Windows\svchost.com
Filesize
40KB

MD5
045910ccff03704d3f4d4024134e53f5

SHA1
ab9491f710e9f205de2c89bfb14354bbfaee214f

SHA256
8fab4e8f332d274e874047c29edca2bdb76a654da518413a2f7760810096550a

SHA512
7468bb3f77b6d910f0ad6e6e511c2543f02e0fe97de32feef677b73be4d09b8f4f3d15b64168758fc42672b496e17ef038f9b44f88840da9f2ae675787e3e7a3

Download Submit
C:\odt\OFFICE~1.EXE
Filesize
5.1MB

MD5
02c3d242fe142b0eabec69211b34bc55

SHA1
ea0a4a6d6078b362f7b3a4ad1505ce49957dc16e

SHA256
2a1ed24be7e3859b46ec3ebc316789ead5f12055853f86a9656e04b4bb771842

SHA512
0efb08492eaaa2e923beddc21566e98fbbef3a102f9415ff310ec616f5c84fd2ba3a7025b05e01c0bdf37e5e2f64dfd845f9254a376144cc7d827e7577dbb099

Download Submit
C:\~0002ftd.tmp
Filesize
109B

MD5
eba2bdce5afa4e313a6d44491a2919eb

SHA1
c7ce068d813220c11d655a1dcf6a17f8cbf9811d

SHA256
190c29360753e1726c676a66a1c24f680392255c2d9e9b901cb5f25313408cd0

SHA512
e2af0a37ad788ea447597fbb2ea9bc6813cc238fa1106760c33a8a8e55012a9eac565ecec9dfb51ed724f28fa68b1f9756659757adc081c2e8c5f0f89b75c1fb

Download Submit
\??\pipe\LOCAL\crashpad_2208_FZHRRTIYNZBLVTAY
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/8-187-0x0000000000000000-mapping.dmp

Download
memory/380-177-0x0000000000000000-mapping.dmp

Download
memory/1032-171-0x0000000000000000-mapping.dmp

Download
memory/1808-182-0x0000000000000000-mapping.dmp

Download
memory/2208-157-0x0000000000000000-mapping.dmp

Download
memory/3472-155-0x0000000000000000-mapping.dmp

Download
memory/3480-180-0x0000000000000000-mapping.dmp

Download
memory/3552-189-0x0000000000000000-mapping.dmp

Download
memory/3640-142-0x0000000000000000-mapping.dmp

Download
memory/4060-185-0x0000000000000000-mapping.dmp

Download
memory/4284-143-0x0000000000000000-mapping.dmp

Download
memory/4324-172-0x0000000000000000-mapping.dmp

Download
memory/4328-139-0x0000000000000000-mapping.dmp

Download
memory/4416-156-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/4416-154-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/4416-148-0x0000000000000000-mapping.dmp

Download
memory/4752-158-0x0000000000000000-mapping.dmp

Download
memory/4880-198-0x0000000000000000-mapping.dmp

Download
memory/5040-132-0x0000000000000000-mapping.dmp

Download
memory/5040-145-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/5040-136-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/5040-134-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download