darkcomet | 9453b720fd014658a07748730b6376835e897d30a53b4be5297331a0e212e147

Analysis

max time kernel
145s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 12:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9453b720fd014658a07748730b6376835e897d30a53b4be5297331a0e212e147.exe
Size

999KB
MD5

2e2db5e73ab5e187b4ed49f0382b8b91
SHA1

890531ff8a5c492a7624854dc8c124e6cf9d38ca
SHA256

9453b720fd014658a07748730b6376835e897d30a53b4be5297331a0e212e147
SHA512

3ba7f26bc8f5706012301fc14f79803c0e6987d2d81680fa959fda1dcbfa060a2fee2e61fd9729ba581f08d26c484eb521a69a185c674b7dcdf7c4c55102f3bb
SSDEEP

12288:M6+GEHHrs3wo5Y/FtqyNzN/0gAhqNOAk55L3KFNqxLenk:M6NEHHrs36FN/0gpNOAkAO0k

Score

10^/10

darkcomet persistence rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 17 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe"	wmpnetk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe"	wmpnetk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe"	wmpnetk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe"	wmpnetk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe"	wmpnetk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe"	wmpnetk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe"	wmpnetk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe"	wmpnetk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe"	wmpnetk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe"	wmpnetk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Service\\svhost.exe"	wmpnetk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe"	wmpnetk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe"	wmpnetk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe"	wmpnetk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe"	wmpnetk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe"	wmpnetk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe,C:\\Windows\\system32\\Service\\svhost.exe"	wmpnetk.exe

Executes dropped EXE 33 IoCs

pid	Process
4640	wmpnetk.exe
2752	svhost.exe
3676	wmpnetk.exe
1668	svhost.exe
4616	wmpnetk.exe
4064	svhost.exe
2004	wmpnetk.exe
3188	svhost.exe
1224	wmpnetk.exe
448	svhost.exe
3196	wmpnetk.exe
1496	svhost.exe
1552	wmpnetk.exe
4788	svhost.exe
4408	wmpnetk.exe
2516	svhost.exe
544	wmpnetk.exe
3480	svhost.exe
1968	wmpnetk.exe
4652	svhost.exe
5100	wmpnetk.exe
2884	svhost.exe
1244	wmpnetk.exe
4928	svhost.exe
5056	wmpnetk.exe
3760	svhost.exe
5320	wmpnetk.exe
5488	svhost.exe
5528	wmpnetk.exe
5644	svhost.exe
5884	wmpnetk.exe
6024	svhost.exe
3000	wmpnetk.exe

Checks BIOS information in registry 2 TTPs 17 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	wmpnetk.exe

Checks computer location settings 2 TTPs 17 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	wmpnetk.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	wmpnetk.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	wmpnetk.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	wmpnetk.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	wmpnetk.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	wmpnetk.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	wmpnetk.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	wmpnetk.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	wmpnetk.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	wmpnetk.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	wmpnetk.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	wmpnetk.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	wmpnetk.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	wmpnetk.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	wmpnetk.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	wmpnetk.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	wmpnetk.exe

Adds Run key to start application 2 TTPs 34 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	wmpnetk.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	wmpnetk.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	wmpnetk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svhost = "C:\\Windows\\system32\\Service\\svhost.exe"	wmpnetk.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	wmpnetk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svhost = "C:\\Windows\\system32\\Service\\svhost.exe"	wmpnetk.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	wmpnetk.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	wmpnetk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svhost = "C:\\Windows\\system32\\Service\\svhost.exe"	wmpnetk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svhost = "C:\\Windows\\system32\\Service\\svhost.exe"	wmpnetk.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	wmpnetk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svhost = "C:\\Windows\\system32\\Service\\svhost.exe"	wmpnetk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svhost = "C:\\Windows\\system32\\Service\\svhost.exe"	wmpnetk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svhost = "C:\\Windows\\system32\\Service\\svhost.exe"	wmpnetk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svhost = "C:\\Windows\\system32\\Service\\svhost.exe"	wmpnetk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svhost = "C:\\Windows\\system32\\Service\\svhost.exe"	wmpnetk.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	wmpnetk.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	wmpnetk.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	wmpnetk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svhost = "C:\\Windows\\system32\\Service\\svhost.exe"	wmpnetk.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	wmpnetk.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	wmpnetk.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	wmpnetk.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	wmpnetk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svhost = "C:\\Windows\\system32\\Service\\svhost.exe"	wmpnetk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svhost = "C:\\Windows\\system32\\Service\\svhost.exe"	wmpnetk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svhost = "C:\\Windows\\system32\\Service\\svhost.exe"	wmpnetk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svhost = "C:\\Windows\\system32\\Service\\svhost.exe"	wmpnetk.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	wmpnetk.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	wmpnetk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svhost = "C:\\Windows\\system32\\Service\\svhost.exe"	wmpnetk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svhost = "C:\\Windows\\system32\\Service\\svhost.exe"	wmpnetk.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	wmpnetk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svhost = "C:\\Windows\\system32\\Service\\svhost.exe"	wmpnetk.exe

Drops file in System32 directory 51 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Service\	wmpnetk.exe
File opened for modification	C:\Windows\SysWOW64\Service\	wmpnetk.exe
File created	C:\Windows\SysWOW64\Service\svhost.exe	wmpnetk.exe
File created	C:\Windows\SysWOW64\Service\svhost.exe	wmpnetk.exe
File opened for modification	C:\Windows\SysWOW64\Service\svhost.exe	wmpnetk.exe
File created	C:\Windows\SysWOW64\Service\svhost.exe	wmpnetk.exe
File created	C:\Windows\SysWOW64\Service\svhost.exe	wmpnetk.exe
File opened for modification	C:\Windows\SysWOW64\Service\	wmpnetk.exe
File created	C:\Windows\SysWOW64\Service\svhost.exe	wmpnetk.exe
File created	C:\Windows\SysWOW64\Service\svhost.exe	wmpnetk.exe
File created	C:\Windows\SysWOW64\Service\svhost.exe	wmpnetk.exe
File created	C:\Windows\SysWOW64\Service\svhost.exe	wmpnetk.exe
File opened for modification	C:\Windows\SysWOW64\Service\	wmpnetk.exe
File opened for modification	C:\Windows\SysWOW64\Service\	wmpnetk.exe
File created	C:\Windows\SysWOW64\Service\svhost.exe	wmpnetk.exe
File opened for modification	C:\Windows\SysWOW64\Service\svhost.exe	wmpnetk.exe
File opened for modification	C:\Windows\SysWOW64\Service\svhost.exe	wmpnetk.exe
File created	C:\Windows\SysWOW64\Service\svhost.exe	wmpnetk.exe
File opened for modification	C:\Windows\SysWOW64\Service\	wmpnetk.exe
File opened for modification	C:\Windows\SysWOW64\Service\	wmpnetk.exe
File opened for modification	C:\Windows\SysWOW64\Service\svhost.exe	wmpnetk.exe
File opened for modification	C:\Windows\SysWOW64\Service\	wmpnetk.exe
File opened for modification	C:\Windows\SysWOW64\Service\svhost.exe	wmpnetk.exe
File opened for modification	C:\Windows\SysWOW64\Service\	wmpnetk.exe
File opened for modification	C:\Windows\SysWOW64\Service\svhost.exe	wmpnetk.exe
File opened for modification	C:\Windows\SysWOW64\Service\svhost.exe	wmpnetk.exe
File opened for modification	C:\Windows\SysWOW64\Service\svhost.exe	wmpnetk.exe
File opened for modification	C:\Windows\SysWOW64\Service\	wmpnetk.exe
File created	C:\Windows\SysWOW64\Service\svhost.exe	wmpnetk.exe
File opened for modification	C:\Windows\SysWOW64\Service\	wmpnetk.exe
File created	C:\Windows\SysWOW64\Service\svhost.exe	wmpnetk.exe
File opened for modification	C:\Windows\SysWOW64\Service\	wmpnetk.exe
File created	C:\Windows\SysWOW64\Service\svhost.exe	wmpnetk.exe
File opened for modification	C:\Windows\SysWOW64\Service\	wmpnetk.exe
File created	C:\Windows\SysWOW64\Service\svhost.exe	wmpnetk.exe
File opened for modification	C:\Windows\SysWOW64\Service\svhost.exe	wmpnetk.exe
File opened for modification	C:\Windows\SysWOW64\Service\	wmpnetk.exe
File opened for modification	C:\Windows\SysWOW64\Service\svhost.exe	wmpnetk.exe
File opened for modification	C:\Windows\SysWOW64\Service\	wmpnetk.exe
File opened for modification	C:\Windows\SysWOW64\Service\svhost.exe	wmpnetk.exe
File opened for modification	C:\Windows\SysWOW64\Service\svhost.exe	wmpnetk.exe
File created	C:\Windows\SysWOW64\Service\svhost.exe	wmpnetk.exe
File opened for modification	C:\Windows\SysWOW64\Service\svhost.exe	wmpnetk.exe
File opened for modification	C:\Windows\SysWOW64\Service\svhost.exe	wmpnetk.exe
File opened for modification	C:\Windows\SysWOW64\Service\	wmpnetk.exe
File created	C:\Windows\SysWOW64\Service\svhost.exe	wmpnetk.exe
File opened for modification	C:\Windows\SysWOW64\Service\svhost.exe	wmpnetk.exe
File created	C:\Windows\SysWOW64\Service\svhost.exe	wmpnetk.exe
File opened for modification	C:\Windows\SysWOW64\Service\svhost.exe	wmpnetk.exe
File opened for modification	C:\Windows\SysWOW64\Service\	wmpnetk.exe
File opened for modification	C:\Windows\SysWOW64\Service\svhost.exe	wmpnetk.exe

Suspicious use of SetThreadContext 30 IoCs

description	pid	Process	procid_target
PID 1488 set thread context of 4640	1488	9453b720fd014658a07748730b6376835e897d30a53b4be5297331a0e212e147.exe	81
PID 4640 set thread context of 1696	4640	wmpnetk.exe	82
PID 2752 set thread context of 3676	2752	svhost.exe	85
PID 3676 set thread context of 5092	3676	wmpnetk.exe	87
PID 1668 set thread context of 4616	1668	svhost.exe	90
PID 4616 set thread context of 3788	4616	wmpnetk.exe	91
PID 4064 set thread context of 2004	4064	svhost.exe	95
PID 3188 set thread context of 1224	3188	svhost.exe	102
PID 1224 set thread context of 1468	1224	wmpnetk.exe	104
PID 448 set thread context of 3196	448	svhost.exe	109
PID 3196 set thread context of 3312	3196	wmpnetk.exe	111
PID 1496 set thread context of 1552	1496	svhost.exe	117
PID 1552 set thread context of 4032	1552	wmpnetk.exe	118
PID 4788 set thread context of 4408	4788	svhost.exe	123
PID 4408 set thread context of 548	4408	wmpnetk.exe	124
PID 2516 set thread context of 544	2516	svhost.exe	128
PID 3480 set thread context of 1968	3480	svhost.exe	131
PID 1968 set thread context of 1452	1968	wmpnetk.exe	132
PID 4652 set thread context of 5100	4652	svhost.exe	134
PID 2884 set thread context of 1244	2884	svhost.exe	139
PID 1244 set thread context of 4148	1244	wmpnetk.exe	146
PID 4928 set thread context of 5056	4928	svhost.exe	154
PID 5056 set thread context of 2884	5056	wmpnetk.exe	156
PID 3760 set thread context of 5320	3760	svhost.exe	168
PID 5320 set thread context of 5376	5320	wmpnetk.exe	169
PID 5488 set thread context of 5528	5488	svhost.exe	172
PID 5644 set thread context of 5884	5644	svhost.exe	177
PID 5884 set thread context of 5944	5884	wmpnetk.exe	178
PID 6024 set thread context of 3000	6024	svhost.exe	185
PID 3000 set thread context of 1496	3000	wmpnetk.exe	192

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	wmpnetk.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	wmpnetk.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	wmpnetk.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	wmpnetk.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	wmpnetk.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	wmpnetk.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmpnetk.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	wmpnetk.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	wmpnetk.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	wmpnetk.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wmpnetk.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wmpnetk.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	wmpnetk.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	wmpnetk.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmpnetk.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wmpnetk.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wmpnetk.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmpnetk.exe

Enumerates system info in registry 2 TTPs 20 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmpnetk.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmpnetk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmpnetk.exe

Modifies registry class 18 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	wmpnetk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	wmpnetk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	wmpnetk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	wmpnetk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	wmpnetk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	wmpnetk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	wmpnetk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	wmpnetk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	wmpnetk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	wmpnetk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	wmpnetk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	wmpnetk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	wmpnetk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	wmpnetk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	wmpnetk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	wmpnetk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	wmpnetk.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4100	msedge.exe
4100	msedge.exe
2736	msedge.exe
2736	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
3348	msedge.exe
3348	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4640	wmpnetk.exe
Token: SeSecurityPrivilege	4640	wmpnetk.exe
Token: SeTakeOwnershipPrivilege	4640	wmpnetk.exe
Token: SeLoadDriverPrivilege	4640	wmpnetk.exe
Token: SeSystemProfilePrivilege	4640	wmpnetk.exe
Token: SeSystemtimePrivilege	4640	wmpnetk.exe
Token: SeProfSingleProcessPrivilege	4640	wmpnetk.exe
Token: SeIncBasePriorityPrivilege	4640	wmpnetk.exe
Token: SeCreatePagefilePrivilege	4640	wmpnetk.exe
Token: SeBackupPrivilege	4640	wmpnetk.exe
Token: SeRestorePrivilege	4640	wmpnetk.exe
Token: SeShutdownPrivilege	4640	wmpnetk.exe
Token: SeDebugPrivilege	4640	wmpnetk.exe
Token: SeSystemEnvironmentPrivilege	4640	wmpnetk.exe
Token: SeChangeNotifyPrivilege	4640	wmpnetk.exe
Token: SeRemoteShutdownPrivilege	4640	wmpnetk.exe
Token: SeUndockPrivilege	4640	wmpnetk.exe
Token: SeManageVolumePrivilege	4640	wmpnetk.exe
Token: SeImpersonatePrivilege	4640	wmpnetk.exe
Token: SeCreateGlobalPrivilege	4640	wmpnetk.exe
Token: 33	4640	wmpnetk.exe
Token: 34	4640	wmpnetk.exe
Token: 35	4640	wmpnetk.exe
Token: 36	4640	wmpnetk.exe
Token: SeIncreaseQuotaPrivilege	3676	wmpnetk.exe
Token: SeSecurityPrivilege	3676	wmpnetk.exe
Token: SeTakeOwnershipPrivilege	3676	wmpnetk.exe
Token: SeLoadDriverPrivilege	3676	wmpnetk.exe
Token: SeSystemProfilePrivilege	3676	wmpnetk.exe
Token: SeSystemtimePrivilege	3676	wmpnetk.exe
Token: SeProfSingleProcessPrivilege	3676	wmpnetk.exe
Token: SeIncBasePriorityPrivilege	3676	wmpnetk.exe
Token: SeCreatePagefilePrivilege	3676	wmpnetk.exe
Token: SeBackupPrivilege	3676	wmpnetk.exe
Token: SeRestorePrivilege	3676	wmpnetk.exe
Token: SeShutdownPrivilege	3676	wmpnetk.exe
Token: SeDebugPrivilege	3676	wmpnetk.exe
Token: SeSystemEnvironmentPrivilege	3676	wmpnetk.exe
Token: SeChangeNotifyPrivilege	3676	wmpnetk.exe
Token: SeRemoteShutdownPrivilege	3676	wmpnetk.exe
Token: SeUndockPrivilege	3676	wmpnetk.exe
Token: SeManageVolumePrivilege	3676	wmpnetk.exe
Token: SeImpersonatePrivilege	3676	wmpnetk.exe
Token: SeCreateGlobalPrivilege	3676	wmpnetk.exe
Token: 33	3676	wmpnetk.exe
Token: 34	3676	wmpnetk.exe
Token: 35	3676	wmpnetk.exe
Token: 36	3676	wmpnetk.exe
Token: SeIncreaseQuotaPrivilege	4616	wmpnetk.exe
Token: SeSecurityPrivilege	4616	wmpnetk.exe
Token: SeTakeOwnershipPrivilege	4616	wmpnetk.exe
Token: SeLoadDriverPrivilege	4616	wmpnetk.exe
Token: SeSystemProfilePrivilege	4616	wmpnetk.exe
Token: SeSystemtimePrivilege	4616	wmpnetk.exe
Token: SeProfSingleProcessPrivilege	4616	wmpnetk.exe
Token: SeIncBasePriorityPrivilege	4616	wmpnetk.exe
Token: SeCreatePagefilePrivilege	4616	wmpnetk.exe
Token: SeBackupPrivilege	4616	wmpnetk.exe
Token: SeRestorePrivilege	4616	wmpnetk.exe
Token: SeShutdownPrivilege	4616	wmpnetk.exe
Token: SeDebugPrivilege	4616	wmpnetk.exe
Token: SeSystemEnvironmentPrivilege	4616	wmpnetk.exe
Token: SeChangeNotifyPrivilege	4616	wmpnetk.exe
Token: SeRemoteShutdownPrivilege	4616	wmpnetk.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2736	msedge.exe
2736	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 4640	1488	9453b720fd014658a07748730b6376835e897d30a53b4be5297331a0e212e147.exe	81
PID 1488 wrote to memory of 4640	1488	9453b720fd014658a07748730b6376835e897d30a53b4be5297331a0e212e147.exe	81
PID 1488 wrote to memory of 4640	1488	9453b720fd014658a07748730b6376835e897d30a53b4be5297331a0e212e147.exe	81
PID 1488 wrote to memory of 4640	1488	9453b720fd014658a07748730b6376835e897d30a53b4be5297331a0e212e147.exe	81
PID 1488 wrote to memory of 4640	1488	9453b720fd014658a07748730b6376835e897d30a53b4be5297331a0e212e147.exe	81
PID 1488 wrote to memory of 4640	1488	9453b720fd014658a07748730b6376835e897d30a53b4be5297331a0e212e147.exe	81
PID 1488 wrote to memory of 4640	1488	9453b720fd014658a07748730b6376835e897d30a53b4be5297331a0e212e147.exe	81
PID 1488 wrote to memory of 4640	1488	9453b720fd014658a07748730b6376835e897d30a53b4be5297331a0e212e147.exe	81
PID 1488 wrote to memory of 4640	1488	9453b720fd014658a07748730b6376835e897d30a53b4be5297331a0e212e147.exe	81
PID 1488 wrote to memory of 4640	1488	9453b720fd014658a07748730b6376835e897d30a53b4be5297331a0e212e147.exe	81
PID 1488 wrote to memory of 4640	1488	9453b720fd014658a07748730b6376835e897d30a53b4be5297331a0e212e147.exe	81
PID 1488 wrote to memory of 4640	1488	9453b720fd014658a07748730b6376835e897d30a53b4be5297331a0e212e147.exe	81
PID 1488 wrote to memory of 4640	1488	9453b720fd014658a07748730b6376835e897d30a53b4be5297331a0e212e147.exe	81
PID 1488 wrote to memory of 4640	1488	9453b720fd014658a07748730b6376835e897d30a53b4be5297331a0e212e147.exe	81
PID 1488 wrote to memory of 4640	1488	9453b720fd014658a07748730b6376835e897d30a53b4be5297331a0e212e147.exe	81
PID 1488 wrote to memory of 4640	1488	9453b720fd014658a07748730b6376835e897d30a53b4be5297331a0e212e147.exe	81
PID 1488 wrote to memory of 4640	1488	9453b720fd014658a07748730b6376835e897d30a53b4be5297331a0e212e147.exe	81
PID 1488 wrote to memory of 4640	1488	9453b720fd014658a07748730b6376835e897d30a53b4be5297331a0e212e147.exe	81
PID 4640 wrote to memory of 1696	4640	wmpnetk.exe	82
PID 4640 wrote to memory of 1696	4640	wmpnetk.exe	82
PID 4640 wrote to memory of 1696	4640	wmpnetk.exe	82
PID 4640 wrote to memory of 1696	4640	wmpnetk.exe	82
PID 4640 wrote to memory of 1696	4640	wmpnetk.exe	82
PID 4640 wrote to memory of 2752	4640	wmpnetk.exe	83
PID 4640 wrote to memory of 2752	4640	wmpnetk.exe	83
PID 4640 wrote to memory of 2752	4640	wmpnetk.exe	83
PID 2752 wrote to memory of 3676	2752	svhost.exe	85
PID 2752 wrote to memory of 3676	2752	svhost.exe	85
PID 2752 wrote to memory of 3676	2752	svhost.exe	85
PID 1696 wrote to memory of 2736	1696	explorer.exe	84
PID 1696 wrote to memory of 2736	1696	explorer.exe	84
PID 2752 wrote to memory of 3676	2752	svhost.exe	85
PID 2752 wrote to memory of 3676	2752	svhost.exe	85
PID 2752 wrote to memory of 3676	2752	svhost.exe	85
PID 2752 wrote to memory of 3676	2752	svhost.exe	85
PID 2752 wrote to memory of 3676	2752	svhost.exe	85
PID 2752 wrote to memory of 3676	2752	svhost.exe	85
PID 2752 wrote to memory of 3676	2752	svhost.exe	85
PID 2752 wrote to memory of 3676	2752	svhost.exe	85
PID 2752 wrote to memory of 3676	2752	svhost.exe	85
PID 2752 wrote to memory of 3676	2752	svhost.exe	85
PID 2752 wrote to memory of 3676	2752	svhost.exe	85
PID 2752 wrote to memory of 3676	2752	svhost.exe	85
PID 2752 wrote to memory of 3676	2752	svhost.exe	85
PID 2752 wrote to memory of 3676	2752	svhost.exe	85
PID 2752 wrote to memory of 3676	2752	svhost.exe	85
PID 2736 wrote to memory of 220	2736	msedge.exe	86
PID 2736 wrote to memory of 220	2736	msedge.exe	86
PID 3676 wrote to memory of 5092	3676	wmpnetk.exe	87
PID 3676 wrote to memory of 5092	3676	wmpnetk.exe	87
PID 3676 wrote to memory of 5092	3676	wmpnetk.exe	87
PID 3676 wrote to memory of 5092	3676	wmpnetk.exe	87
PID 3676 wrote to memory of 5092	3676	wmpnetk.exe	87
PID 3676 wrote to memory of 1668	3676	wmpnetk.exe	89
PID 3676 wrote to memory of 1668	3676	wmpnetk.exe	89
PID 3676 wrote to memory of 1668	3676	wmpnetk.exe	89
PID 1668 wrote to memory of 4616	1668	svhost.exe	90
PID 1668 wrote to memory of 4616	1668	svhost.exe	90
PID 1668 wrote to memory of 4616	1668	svhost.exe	90
PID 1668 wrote to memory of 4616	1668	svhost.exe	90
PID 1668 wrote to memory of 4616	1668	svhost.exe	90
PID 1668 wrote to memory of 4616	1668	svhost.exe	90
PID 1668 wrote to memory of 4616	1668	svhost.exe	90
PID 1668 wrote to memory of 4616	1668	svhost.exe	90

C:\Users\Admin\AppData\Local\Temp\9453b720fd014658a07748730b6376835e897d30a53b4be5297331a0e212e147.exe
"C:\Users\Admin\AppData\Local\Temp\9453b720fd014658a07748730b6376835e897d30a53b4be5297331a0e212e147.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe
  C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks computer location settings
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4640
- - C:\Windows\SysWOW64\explorer.exe
    "C:\Windows\SysWOW64\explorer.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=explorer.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
      4⤵
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2736
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd8,0x104,0x7ffc930c46f8,0x7ffc930c4708,0x7ffc930c4718
        5⤵
        
        PID:220
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,10655544911895633296,2586919329190160384,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
        5⤵
        
        PID:4604
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,10655544911895633296,2586919329190160384,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4100
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,10655544911895633296,2586919329190160384,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:8
        5⤵
        
        PID:4484
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10655544911895633296,2586919329190160384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3128 /prefetch:1
        5⤵
        
        PID:2336
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10655544911895633296,2586919329190160384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
        5⤵
        
        PID:3680
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10655544911895633296,2586919329190160384,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4448 /prefetch:1
        5⤵
        
        PID:216
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10655544911895633296,2586919329190160384,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
        5⤵
        
        PID:1756
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10655544911895633296,2586919329190160384,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
        5⤵
        
        PID:388
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10655544911895633296,2586919329190160384,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
        5⤵
        
        PID:2980
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10655544911895633296,2586919329190160384,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6356 /prefetch:1
        5⤵
        
        PID:1668
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10655544911895633296,2586919329190160384,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6448 /prefetch:1
        5⤵
        
        PID:460
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10655544911895633296,2586919329190160384,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6600 /prefetch:1
        5⤵
        
        PID:3552
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2100,10655544911895633296,2586919329190160384,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6264 /prefetch:8
        5⤵
        
        PID:1448
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10655544911895633296,2586919329190160384,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7276 /prefetch:1
        5⤵
        
        PID:5112
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10655544911895633296,2586919329190160384,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7328 /prefetch:1
        5⤵
        
        PID:2344
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10655544911895633296,2586919329190160384,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7480 /prefetch:1
        5⤵
        
        PID:3744
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10655544911895633296,2586919329190160384,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7528 /prefetch:1
        5⤵
        
        PID:1420
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10655544911895633296,2586919329190160384,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7300 /prefetch:1
        5⤵
        
        PID:2716
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10655544911895633296,2586919329190160384,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
        5⤵
        
        PID:4680
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10655544911895633296,2586919329190160384,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
        5⤵
        
        PID:2696
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10655544911895633296,2586919329190160384,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
        5⤵
        
        PID:4596
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10655544911895633296,2586919329190160384,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8216 /prefetch:1
        5⤵
        
        PID:5744
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10655544911895633296,2586919329190160384,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6572 /prefetch:1
        5⤵
        
        PID:5756
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,10655544911895633296,2586919329190160384,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5572 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1332
- - C:\Windows\SysWOW64\Service\svhost.exe
    "C:\Windows\system32\Service\svhost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2752
  - - C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe
      C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Checks BIOS information in registry
      Checks computer location settings
      Adds Run key to start application
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      Checks processor information in registry
      Enumerates system info in registry
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3676
    - - C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        5⤵
        
        PID:5092
    - - C:\Windows\SysWOW64\Service\svhost.exe
        
        "C:\Windows\system32\Service\svhost.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1668
      - C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe
        
        C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe
        6⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Checks BIOS information in registry
        Checks computer location settings
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Checks processor information in registry
        Enumerates system info in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4616
        
        C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        7⤵
        
        PID:3788
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=explorer.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        8⤵
        
        PID:4752
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc930c46f8,0x7ffc930c4708,0x7ffc930c4718
        9⤵
        
        PID:3192
        
        C:\Windows\SysWOW64\Service\svhost.exe
        
        "C:\Windows\system32\Service\svhost.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4064
        
        C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe
        
        C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe
        8⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Checks BIOS information in registry
        Checks computer location settings
        Adds Run key to start application
        Drops file in System32 directory
        Checks processor information in registry
        Enumerates system info in registry
        Modifies registry class
        
        PID:2004
        
        C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        9⤵
        
        PID:4032
        
        C:\Windows\SysWOW64\Service\svhost.exe
        
        "C:\Windows\system32\Service\svhost.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3188
        
        C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe
        
        C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe
        10⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Checks BIOS information in registry
        Checks computer location settings
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Checks processor information in registry
        Enumerates system info in registry
        Modifies registry class
        
        PID:1224
        
        C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        11⤵
        
        PID:1468
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=explorer.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        12⤵
        
        PID:3576
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc930c46f8,0x7ffc930c4708,0x7ffc930c4718
        13⤵
        
        PID:4012
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=explorer.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        12⤵
        
        PID:384
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc930c46f8,0x7ffc930c4708,0x7ffc930c4718
        13⤵
        
        PID:4932
        
        C:\Windows\SysWOW64\Service\svhost.exe
        
        "C:\Windows\system32\Service\svhost.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:448
        
        C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe
        
        C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe
        12⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Checks BIOS information in registry
        Checks computer location settings
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Checks processor information in registry
        Enumerates system info in registry
        Modifies registry class
        
        PID:3196
        
        C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        13⤵
        
        PID:3312
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=explorer.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        14⤵
        
        PID:2444
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc930c46f8,0x7ffc930c4708,0x7ffc930c4718
        15⤵
        
        PID:3936
        
        C:\Windows\SysWOW64\Service\svhost.exe
        
        "C:\Windows\system32\Service\svhost.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1496
        
        C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe
        
        C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe
        14⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Checks BIOS information in registry
        Checks computer location settings
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Checks processor information in registry
        Enumerates system info in registry
        Modifies registry class
        
        PID:1552
        
        C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        15⤵
        
        PID:4032
        
        C:\Windows\SysWOW64\Service\svhost.exe
        
        "C:\Windows\system32\Service\svhost.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4788
        
        C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe
        
        C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe
        16⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Checks BIOS information in registry
        Checks computer location settings
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Checks processor information in registry
        Enumerates system info in registry
        Modifies registry class
        
        PID:4408
        
        C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        17⤵
        
        PID:548
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=explorer.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        18⤵
        
        PID:4012
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ffc930c46f8,0x7ffc930c4708,0x7ffc930c4718
        19⤵
        
        PID:2096
        
        C:\Windows\SysWOW64\Service\svhost.exe
        
        "C:\Windows\system32\Service\svhost.exe"
        17⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe
        
        C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe
        18⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Checks BIOS information in registry
        Checks computer location settings
        Adds Run key to start application
        Drops file in System32 directory
        Checks processor information in registry
        Enumerates system info in registry
        Modifies registry class
        
        PID:544
        
        C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        19⤵
        
        PID:2324
        
        C:\Windows\SysWOW64\Service\svhost.exe
        
        "C:\Windows\system32\Service\svhost.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3480
        
        C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe
        
        C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe
        20⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Checks BIOS information in registry
        Checks computer location settings
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Checks processor information in registry
        Enumerates system info in registry
        Modifies registry class
        
        PID:1968
        
        C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        21⤵
        
        PID:1452
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=explorer.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        22⤵
        
        PID:1528
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc930c46f8,0x7ffc930c4708,0x7ffc930c4718
        23⤵
        
        PID:4728
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=explorer.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        22⤵
        
        PID:4740
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc930c46f8,0x7ffc930c4708,0x7ffc930c4718
        23⤵
        
        PID:1032
        
        C:\Windows\SysWOW64\Service\svhost.exe
        
        "C:\Windows\system32\Service\svhost.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4652
        
        C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe
        
        C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe
        22⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Checks BIOS information in registry
        Checks computer location settings
        Adds Run key to start application
        Drops file in System32 directory
        Checks processor information in registry
        Enumerates system info in registry
        Modifies registry class
        
        PID:5100
        
        C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        23⤵
        
        PID:988
        
        C:\Windows\SysWOW64\Service\svhost.exe
        
        "C:\Windows\system32\Service\svhost.exe"
        23⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe
        
        C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe
        24⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Checks BIOS information in registry
        Checks computer location settings
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Checks processor information in registry
        Enumerates system info in registry
        Modifies registry class
        
        PID:1244
        
        C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        25⤵
        
        PID:4148
        
        C:\Windows\SysWOW64\Service\svhost.exe
        
        "C:\Windows\system32\Service\svhost.exe"
        25⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe
        
        C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe
        26⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Checks BIOS information in registry
        Checks computer location settings
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Checks processor information in registry
        Enumerates system info in registry
        Modifies registry class
        
        PID:5056
        
        C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        27⤵
        
        PID:2884
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=explorer.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        28⤵
        
        PID:5888
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc930c46f8,0x7ffc930c4708,0x7ffc930c4718
        29⤵
        
        PID:5904
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,14883446315462902749,11031909715800394181,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
        29⤵
        
        PID:2064
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,14883446315462902749,11031909715800394181,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
        29⤵
        
        PID:3696
        
        C:\Windows\SysWOW64\Service\svhost.exe
        
        "C:\Windows\system32\Service\svhost.exe"
        27⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3760
        
        C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe
        
        C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe
        28⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Checks BIOS information in registry
        Checks computer location settings
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Checks processor information in registry
        Enumerates system info in registry
        Modifies registry class
        
        PID:5320
        
        C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        29⤵
        
        PID:5376
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=explorer.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        30⤵
        
        PID:6096
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc930c46f8,0x7ffc930c4708,0x7ffc930c4718
        31⤵
        
        PID:6112
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,9913189574760420819,2995113609779158044,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
        31⤵
        
        PID:4856
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,9913189574760420819,2995113609779158044,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
        31⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3348
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,9913189574760420819,2995113609779158044,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3140 /prefetch:8
        31⤵
        
        PID:4672
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9913189574760420819,2995113609779158044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3572 /prefetch:1
        31⤵
        
        PID:1920
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9913189574760420819,2995113609779158044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3588 /prefetch:1
        31⤵
        
        PID:4840
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2112,9913189574760420819,2995113609779158044,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4892 /prefetch:8
        31⤵
        
        PID:4144
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9913189574760420819,2995113609779158044,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
        31⤵
        
        PID:5532
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9913189574760420819,2995113609779158044,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
        31⤵
        
        PID:2448
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9913189574760420819,2995113609779158044,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
        31⤵
        
        PID:5464
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=explorer.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        30⤵
        
        PID:5012
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc930c46f8,0x7ffc930c4708,0x7ffc930c4718
        31⤵
        
        PID:5444
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,14409702529392334122,3752754374172731645,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:3
        31⤵
        
        PID:3324
        
        C:\Windows\SysWOW64\Service\svhost.exe
        
        "C:\Windows\system32\Service\svhost.exe"
        29⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe
        
        C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe
        30⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Checks BIOS information in registry
        Checks computer location settings
        Adds Run key to start application
        Drops file in System32 directory
        Checks processor information in registry
        Enumerates system info in registry
        Modifies registry class
        
        PID:5528
        
        C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        31⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Service\svhost.exe
        
        "C:\Windows\system32\Service\svhost.exe"
        31⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe
        
        C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe
        32⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Checks BIOS information in registry
        Checks computer location settings
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Checks processor information in registry
        Enumerates system info in registry
        Modifies registry class
        
        PID:5884
        
        C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        33⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Service\svhost.exe
        
        "C:\Windows\system32\Service\svhost.exe"
        33⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe
        
        C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe
        34⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Checks BIOS information in registry
        Checks computer location settings
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Checks processor information in registry
        Enumerates system info in registry
        Modifies registry class
        
        PID:3000
        
        C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        35⤵
        
        PID:1496
        
        C:\Windows\SysWOW64\Service\svhost.exe
        
        "C:\Windows\system32\Service\svhost.exe"
        35⤵
        
        PID:532
        
        C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe
        
        C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe
        36⤵
        
        PID:836
        
        C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        37⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Service\svhost.exe
        
        "C:\Windows\system32\Service\svhost.exe"
        37⤵
        
        PID:796
        
        C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe
        
        C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe
        38⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        39⤵
        
        PID:2872
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=explorer.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        40⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\Service\svhost.exe
        
        "C:\Windows\system32\Service\svhost.exe"
        39⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe
        
        C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe
        40⤵
        
        PID:5076
        
        C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        41⤵
        
        PID:3484
        
        C:\Windows\SysWOW64\Service\svhost.exe
        
        "C:\Windows\system32\Service\svhost.exe"
        41⤵
        
        PID:3668
        
        C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe
        
        C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe
        42⤵
        
        PID:4584
        
        C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        43⤵
        
        PID:2156

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc930c46f8,0x7ffc930c4708,0x7ffc930c4718
1⤵
PID:2780

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\svhost.exe.log

Filesize
500B

MD5
b9f835502a5270f28cefccb089149ba7

SHA1
31d85ee60a54ead7918958b9d4cfe85bea2a8cc8

SHA256
bd1d609c1d6595c0ab36f4ba135037760b0354b951f15f374893d1feeb9d33fa

SHA512
955dffc7ad7a359eb46c4b51300589a4b03e1969db1ad22749c7c5bd6cca9fcdef5e8046f2c822114341efb34b40526fa49cfb4ebcdcf21282c75c2b446f713b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
71b657795f1d63721f304fcf46915016

SHA1
d2cabf753a2b8888642a3a26878e7f47784153b2

SHA256
f6d95ff8ef0a6098a3c31bedf0f623555cf3855bab0142f2350f07eb85832c28

SHA512
dd1d8e6e56463cba11da14b604c4dcedf13e1914c4afab93121f6535a30120e0d907c0129c6eebfc8a0a70a557d2f6d467a24fe0bac960c79519049e1931ea20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
71b657795f1d63721f304fcf46915016

SHA1
d2cabf753a2b8888642a3a26878e7f47784153b2

SHA256
f6d95ff8ef0a6098a3c31bedf0f623555cf3855bab0142f2350f07eb85832c28

SHA512
dd1d8e6e56463cba11da14b604c4dcedf13e1914c4afab93121f6535a30120e0d907c0129c6eebfc8a0a70a557d2f6d467a24fe0bac960c79519049e1931ea20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
71b657795f1d63721f304fcf46915016

SHA1
d2cabf753a2b8888642a3a26878e7f47784153b2

SHA256
f6d95ff8ef0a6098a3c31bedf0f623555cf3855bab0142f2350f07eb85832c28

SHA512
dd1d8e6e56463cba11da14b604c4dcedf13e1914c4afab93121f6535a30120e0d907c0129c6eebfc8a0a70a557d2f6d467a24fe0bac960c79519049e1931ea20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
71b657795f1d63721f304fcf46915016

SHA1
d2cabf753a2b8888642a3a26878e7f47784153b2

SHA256
f6d95ff8ef0a6098a3c31bedf0f623555cf3855bab0142f2350f07eb85832c28

SHA512
dd1d8e6e56463cba11da14b604c4dcedf13e1914c4afab93121f6535a30120e0d907c0129c6eebfc8a0a70a557d2f6d467a24fe0bac960c79519049e1931ea20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
71b657795f1d63721f304fcf46915016

SHA1
d2cabf753a2b8888642a3a26878e7f47784153b2

SHA256
f6d95ff8ef0a6098a3c31bedf0f623555cf3855bab0142f2350f07eb85832c28

SHA512
dd1d8e6e56463cba11da14b604c4dcedf13e1914c4afab93121f6535a30120e0d907c0129c6eebfc8a0a70a557d2f6d467a24fe0bac960c79519049e1931ea20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
71b657795f1d63721f304fcf46915016

SHA1
d2cabf753a2b8888642a3a26878e7f47784153b2

SHA256
f6d95ff8ef0a6098a3c31bedf0f623555cf3855bab0142f2350f07eb85832c28

SHA512
dd1d8e6e56463cba11da14b604c4dcedf13e1914c4afab93121f6535a30120e0d907c0129c6eebfc8a0a70a557d2f6d467a24fe0bac960c79519049e1931ea20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
71b657795f1d63721f304fcf46915016

SHA1
d2cabf753a2b8888642a3a26878e7f47784153b2

SHA256
f6d95ff8ef0a6098a3c31bedf0f623555cf3855bab0142f2350f07eb85832c28

SHA512
dd1d8e6e56463cba11da14b604c4dcedf13e1914c4afab93121f6535a30120e0d907c0129c6eebfc8a0a70a557d2f6d467a24fe0bac960c79519049e1931ea20

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe

Filesize
1.1MB

MD5
d881de17aa8f2e2c08cbb7b265f928f9

SHA1
08936aebc87decf0af6e8eada191062b5e65ac2a

SHA256
b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

SHA512
5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe

Filesize
1.1MB

MD5
d881de17aa8f2e2c08cbb7b265f928f9

SHA1
08936aebc87decf0af6e8eada191062b5e65ac2a

SHA256
b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

SHA512
5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe

Filesize
1.1MB

MD5
d881de17aa8f2e2c08cbb7b265f928f9

SHA1
08936aebc87decf0af6e8eada191062b5e65ac2a

SHA256
b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

SHA512
5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe

Filesize
1.1MB

MD5
d881de17aa8f2e2c08cbb7b265f928f9

SHA1
08936aebc87decf0af6e8eada191062b5e65ac2a

SHA256
b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

SHA512
5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe

Filesize
1.1MB

MD5
d881de17aa8f2e2c08cbb7b265f928f9

SHA1
08936aebc87decf0af6e8eada191062b5e65ac2a

SHA256
b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

SHA512
5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe

Filesize
1.1MB

MD5
d881de17aa8f2e2c08cbb7b265f928f9

SHA1
08936aebc87decf0af6e8eada191062b5e65ac2a

SHA256
b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

SHA512
5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe

Filesize
1.1MB

MD5
d881de17aa8f2e2c08cbb7b265f928f9

SHA1
08936aebc87decf0af6e8eada191062b5e65ac2a

SHA256
b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

SHA512
5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe

Filesize
1.1MB

MD5
d881de17aa8f2e2c08cbb7b265f928f9

SHA1
08936aebc87decf0af6e8eada191062b5e65ac2a

SHA256
b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

SHA512
5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe

Filesize
1.1MB

MD5
d881de17aa8f2e2c08cbb7b265f928f9

SHA1
08936aebc87decf0af6e8eada191062b5e65ac2a

SHA256
b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

SHA512
5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe

Filesize
1.1MB

MD5
d881de17aa8f2e2c08cbb7b265f928f9

SHA1
08936aebc87decf0af6e8eada191062b5e65ac2a

SHA256
b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

SHA512
5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe

Filesize
1.1MB

MD5
d881de17aa8f2e2c08cbb7b265f928f9

SHA1
08936aebc87decf0af6e8eada191062b5e65ac2a

SHA256
b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

SHA512
5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe

Filesize
1.1MB

MD5
d881de17aa8f2e2c08cbb7b265f928f9

SHA1
08936aebc87decf0af6e8eada191062b5e65ac2a

SHA256
b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

SHA512
5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe

Filesize
1.1MB

MD5
d881de17aa8f2e2c08cbb7b265f928f9

SHA1
08936aebc87decf0af6e8eada191062b5e65ac2a

SHA256
b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

SHA512
5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe

Filesize
1.1MB

MD5
d881de17aa8f2e2c08cbb7b265f928f9

SHA1
08936aebc87decf0af6e8eada191062b5e65ac2a

SHA256
b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

SHA512
5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe

Filesize
1.1MB

MD5
d881de17aa8f2e2c08cbb7b265f928f9

SHA1
08936aebc87decf0af6e8eada191062b5e65ac2a

SHA256
b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

SHA512
5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe

Filesize
1.1MB

MD5
d881de17aa8f2e2c08cbb7b265f928f9

SHA1
08936aebc87decf0af6e8eada191062b5e65ac2a

SHA256
b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

SHA512
5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe

Filesize
1.1MB

MD5
d881de17aa8f2e2c08cbb7b265f928f9

SHA1
08936aebc87decf0af6e8eada191062b5e65ac2a

SHA256
b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

SHA512
5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe

Filesize
1.1MB

MD5
d881de17aa8f2e2c08cbb7b265f928f9

SHA1
08936aebc87decf0af6e8eada191062b5e65ac2a

SHA256
b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

SHA512
5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe

Filesize
1.1MB

MD5
d881de17aa8f2e2c08cbb7b265f928f9

SHA1
08936aebc87decf0af6e8eada191062b5e65ac2a

SHA256
b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

SHA512
5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe

Filesize
1.1MB

MD5
d881de17aa8f2e2c08cbb7b265f928f9

SHA1
08936aebc87decf0af6e8eada191062b5e65ac2a

SHA256
b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

SHA512
5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe

Filesize
1.1MB

MD5
d881de17aa8f2e2c08cbb7b265f928f9

SHA1
08936aebc87decf0af6e8eada191062b5e65ac2a

SHA256
b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

SHA512
5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe

Filesize
1.1MB

MD5
d881de17aa8f2e2c08cbb7b265f928f9

SHA1
08936aebc87decf0af6e8eada191062b5e65ac2a

SHA256
b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

SHA512
5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe

Filesize
1.1MB

MD5
d881de17aa8f2e2c08cbb7b265f928f9

SHA1
08936aebc87decf0af6e8eada191062b5e65ac2a

SHA256
b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

SHA512
5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe

Filesize
1.1MB

MD5
d881de17aa8f2e2c08cbb7b265f928f9

SHA1
08936aebc87decf0af6e8eada191062b5e65ac2a

SHA256
b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

SHA512
5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

Download Submit
C:\Windows\SysWOW64\Service\svhost.exe

Filesize
999KB

MD5
2e2db5e73ab5e187b4ed49f0382b8b91

SHA1
890531ff8a5c492a7624854dc8c124e6cf9d38ca

SHA256
9453b720fd014658a07748730b6376835e897d30a53b4be5297331a0e212e147

SHA512
3ba7f26bc8f5706012301fc14f79803c0e6987d2d81680fa959fda1dcbfa060a2fee2e61fd9729ba581f08d26c484eb521a69a185c674b7dcdf7c4c55102f3bb

Download Submit
C:\Windows\SysWOW64\Service\svhost.exe

Filesize
999KB

MD5
2e2db5e73ab5e187b4ed49f0382b8b91

SHA1
890531ff8a5c492a7624854dc8c124e6cf9d38ca

SHA256
9453b720fd014658a07748730b6376835e897d30a53b4be5297331a0e212e147

SHA512
3ba7f26bc8f5706012301fc14f79803c0e6987d2d81680fa959fda1dcbfa060a2fee2e61fd9729ba581f08d26c484eb521a69a185c674b7dcdf7c4c55102f3bb

Download Submit
C:\Windows\SysWOW64\Service\svhost.exe

Filesize
999KB

MD5
2e2db5e73ab5e187b4ed49f0382b8b91

SHA1
890531ff8a5c492a7624854dc8c124e6cf9d38ca

SHA256
9453b720fd014658a07748730b6376835e897d30a53b4be5297331a0e212e147

SHA512
3ba7f26bc8f5706012301fc14f79803c0e6987d2d81680fa959fda1dcbfa060a2fee2e61fd9729ba581f08d26c484eb521a69a185c674b7dcdf7c4c55102f3bb

Download Submit
C:\Windows\SysWOW64\Service\svhost.exe

Filesize
999KB

MD5
2e2db5e73ab5e187b4ed49f0382b8b91

SHA1
890531ff8a5c492a7624854dc8c124e6cf9d38ca

SHA256
9453b720fd014658a07748730b6376835e897d30a53b4be5297331a0e212e147

SHA512
3ba7f26bc8f5706012301fc14f79803c0e6987d2d81680fa959fda1dcbfa060a2fee2e61fd9729ba581f08d26c484eb521a69a185c674b7dcdf7c4c55102f3bb

Download Submit
C:\Windows\SysWOW64\Service\svhost.exe

Filesize
999KB

MD5
2e2db5e73ab5e187b4ed49f0382b8b91

SHA1
890531ff8a5c492a7624854dc8c124e6cf9d38ca

SHA256
9453b720fd014658a07748730b6376835e897d30a53b4be5297331a0e212e147

SHA512
3ba7f26bc8f5706012301fc14f79803c0e6987d2d81680fa959fda1dcbfa060a2fee2e61fd9729ba581f08d26c484eb521a69a185c674b7dcdf7c4c55102f3bb

Download Submit
C:\Windows\SysWOW64\Service\svhost.exe

Filesize
999KB

MD5
2e2db5e73ab5e187b4ed49f0382b8b91

SHA1
890531ff8a5c492a7624854dc8c124e6cf9d38ca

SHA256
9453b720fd014658a07748730b6376835e897d30a53b4be5297331a0e212e147

SHA512
3ba7f26bc8f5706012301fc14f79803c0e6987d2d81680fa959fda1dcbfa060a2fee2e61fd9729ba581f08d26c484eb521a69a185c674b7dcdf7c4c55102f3bb

Download Submit
C:\Windows\SysWOW64\Service\svhost.exe

Filesize
999KB

MD5
2e2db5e73ab5e187b4ed49f0382b8b91

SHA1
890531ff8a5c492a7624854dc8c124e6cf9d38ca

SHA256
9453b720fd014658a07748730b6376835e897d30a53b4be5297331a0e212e147

SHA512
3ba7f26bc8f5706012301fc14f79803c0e6987d2d81680fa959fda1dcbfa060a2fee2e61fd9729ba581f08d26c484eb521a69a185c674b7dcdf7c4c55102f3bb

Download Submit
C:\Windows\SysWOW64\Service\svhost.exe

Filesize
999KB

MD5
2e2db5e73ab5e187b4ed49f0382b8b91

SHA1
890531ff8a5c492a7624854dc8c124e6cf9d38ca

SHA256
9453b720fd014658a07748730b6376835e897d30a53b4be5297331a0e212e147

SHA512
3ba7f26bc8f5706012301fc14f79803c0e6987d2d81680fa959fda1dcbfa060a2fee2e61fd9729ba581f08d26c484eb521a69a185c674b7dcdf7c4c55102f3bb

Download Submit
C:\Windows\SysWOW64\Service\svhost.exe

Filesize
999KB

MD5
2e2db5e73ab5e187b4ed49f0382b8b91

SHA1
890531ff8a5c492a7624854dc8c124e6cf9d38ca

SHA256
9453b720fd014658a07748730b6376835e897d30a53b4be5297331a0e212e147

SHA512
3ba7f26bc8f5706012301fc14f79803c0e6987d2d81680fa959fda1dcbfa060a2fee2e61fd9729ba581f08d26c484eb521a69a185c674b7dcdf7c4c55102f3bb

Download Submit
C:\Windows\SysWOW64\Service\svhost.exe

Filesize
999KB

MD5
2e2db5e73ab5e187b4ed49f0382b8b91

SHA1
890531ff8a5c492a7624854dc8c124e6cf9d38ca

SHA256
9453b720fd014658a07748730b6376835e897d30a53b4be5297331a0e212e147

SHA512
3ba7f26bc8f5706012301fc14f79803c0e6987d2d81680fa959fda1dcbfa060a2fee2e61fd9729ba581f08d26c484eb521a69a185c674b7dcdf7c4c55102f3bb

Download Submit
C:\Windows\SysWOW64\Service\svhost.exe

Filesize
999KB

MD5
2e2db5e73ab5e187b4ed49f0382b8b91

SHA1
890531ff8a5c492a7624854dc8c124e6cf9d38ca

SHA256
9453b720fd014658a07748730b6376835e897d30a53b4be5297331a0e212e147

SHA512
3ba7f26bc8f5706012301fc14f79803c0e6987d2d81680fa959fda1dcbfa060a2fee2e61fd9729ba581f08d26c484eb521a69a185c674b7dcdf7c4c55102f3bb

Download Submit
C:\Windows\SysWOW64\Service\svhost.exe

Filesize
999KB

MD5
2e2db5e73ab5e187b4ed49f0382b8b91

SHA1
890531ff8a5c492a7624854dc8c124e6cf9d38ca

SHA256
9453b720fd014658a07748730b6376835e897d30a53b4be5297331a0e212e147

SHA512
3ba7f26bc8f5706012301fc14f79803c0e6987d2d81680fa959fda1dcbfa060a2fee2e61fd9729ba581f08d26c484eb521a69a185c674b7dcdf7c4c55102f3bb

Download Submit
memory/448-216-0x00000000723D0000-0x0000000072981000-memory.dmp

Filesize
5.7MB

Download
memory/448-203-0x00000000723D0000-0x0000000072981000-memory.dmp

Filesize
5.7MB

Download
memory/532-373-0x0000000073BF0000-0x00000000741A1000-memory.dmp

Filesize
5.7MB

Download
memory/544-263-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/796-382-0x00000000723D0000-0x0000000072981000-memory.dmp

Filesize
5.7MB

Download
memory/1224-197-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1244-304-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1488-141-0x0000000074C50000-0x0000000075201000-memory.dmp

Filesize
5.7MB

Download
memory/1488-132-0x0000000074C50000-0x0000000075201000-memory.dmp

Filesize
5.7MB

Download
memory/1496-223-0x0000000073200000-0x00000000737B1000-memory.dmp

Filesize
5.7MB

Download
memory/1496-234-0x0000000073200000-0x00000000737B1000-memory.dmp

Filesize
5.7MB

Download
memory/1496-220-0x0000000073200000-0x00000000737B1000-memory.dmp

Filesize
5.7MB

Download
memory/1552-231-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1668-167-0x00000000715B0000-0x0000000071B61000-memory.dmp

Filesize
5.7MB

Download
memory/1668-191-0x00000000715B0000-0x0000000071B61000-memory.dmp

Filesize
5.7MB

Download
memory/1696-143-0x0000000000400000-0x0000000000500000-memory.dmp

Filesize
1024KB

Download
memory/1968-274-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2516-266-0x0000000073BF0000-0x00000000741A1000-memory.dmp

Filesize
5.7MB

Download
memory/2516-257-0x0000000073BF0000-0x00000000741A1000-memory.dmp

Filesize
5.7MB

Download
memory/2752-157-0x0000000073200000-0x00000000737B1000-memory.dmp

Filesize
5.7MB

Download
memory/2884-291-0x00000000723D0000-0x0000000072981000-memory.dmp

Filesize
5.7MB

Download
memory/2884-290-0x00000000723D0000-0x0000000072981000-memory.dmp

Filesize
5.7MB

Download
memory/2884-302-0x00000000723D0000-0x0000000072981000-memory.dmp

Filesize
5.7MB

Download
memory/3188-200-0x00000000723D0000-0x0000000072981000-memory.dmp

Filesize
5.7MB

Download
memory/3188-190-0x00000000723D0000-0x0000000072981000-memory.dmp

Filesize
5.7MB

Download
memory/3188-192-0x00000000723D0000-0x0000000072981000-memory.dmp

Filesize
5.7MB

Download
memory/3196-213-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/3480-275-0x00000000723D0000-0x0000000072981000-memory.dmp

Filesize
5.7MB

Download
memory/3480-269-0x00000000723D0000-0x0000000072981000-memory.dmp

Filesize
5.7MB

Download
memory/3668-395-0x00000000723D0000-0x0000000072981000-memory.dmp

Filesize
5.7MB

Download
memory/3668-391-0x00000000723D0000-0x0000000072981000-memory.dmp

Filesize
5.7MB

Download
memory/3676-152-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/3760-346-0x00000000723D0000-0x0000000072981000-memory.dmp

Filesize
5.7MB

Download
memory/3760-341-0x00000000723D0000-0x0000000072981000-memory.dmp

Filesize
5.7MB

Download
memory/4032-236-0x0000000000400000-0x000000000051F000-memory.dmp

Filesize
1.1MB

Download
memory/4064-177-0x00000000723D0000-0x0000000072981000-memory.dmp

Filesize
5.7MB

Download
memory/4064-182-0x00000000723D0000-0x0000000072981000-memory.dmp

Filesize
5.7MB

Download
memory/4148-316-0x0000000000400000-0x000000000051F000-memory.dmp

Filesize
1.1MB

Download
memory/4616-166-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4640-138-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4640-137-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4640-134-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4640-140-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4652-287-0x00000000723D0000-0x0000000072981000-memory.dmp

Filesize
5.7MB

Download
memory/4788-248-0x00000000723D0000-0x0000000072981000-memory.dmp

Filesize
5.7MB

Download
memory/4928-329-0x00000000723D0000-0x0000000072981000-memory.dmp

Filesize
5.7MB

Download
memory/4928-332-0x00000000723D0000-0x0000000072981000-memory.dmp

Filesize
5.7MB

Download
memory/5092-158-0x0000000000400000-0x000000000051F000-memory.dmp

Filesize
1.1MB

Download
memory/5092-156-0x0000000000400000-0x000000000051F000-memory.dmp

Filesize
1.1MB

Download
memory/5188-387-0x00000000723D0000-0x0000000072981000-memory.dmp

Filesize
5.7MB

Download
memory/5188-386-0x00000000723D0000-0x0000000072981000-memory.dmp

Filesize
5.7MB

Download
memory/5488-350-0x00000000723D0000-0x0000000072981000-memory.dmp

Filesize
5.7MB

Download
memory/5644-357-0x00000000723D0000-0x0000000072981000-memory.dmp

Filesize
5.7MB

Download
memory/5644-351-0x00000000723D0000-0x0000000072981000-memory.dmp

Filesize
5.7MB

Download
memory/5884-356-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/6024-366-0x00000000723D0000-0x0000000072981000-memory.dmp

Filesize
5.7MB

Download
memory/6024-361-0x00000000723D0000-0x0000000072981000-memory.dmp

Filesize
5.7MB

Download
memory/6024-360-0x00000000723D0000-0x0000000072981000-memory.dmp

Filesize
5.7MB

Download