Analysis
- max time kernel
95s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
- submitted
16/01/2023, 23:55
General
- Target file.exe
- Size 228KB
- Sample230116-3ye5nafe38
- SHA256 9e1f021499fd7cea84243b0e3c20d64456b23ab9c3069c1b5bbfccf3b6dc050e
Malware Config
Signatures
- Detects Smokeloader packer 1 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
- Blocklisted process makes network request 4 IoCs
- Downloads MZ/PE file
- Executes dropped EXE 3 IoCs
- Sets DLL path for service in the registry 2 TTPs 1 IoCs
- Sets service image path in registry 2 TTPs 2 IoCs
- Loads dropped DLL 3 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious use of SetThreadContext 7 IoCs
- Drops file in Program Files directory 13 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 3 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 4 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 22 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\C662.exeC:\Users\Admin\AppData\Local\Temp\C662.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Sdaaysrpyefiy.tmp",Qowsuiaedfeupa2⤵
- Blocklisted process makes network request
- Sets DLL path for service in the registry
- Sets service image path in registry
- Loads dropped DLL
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Users\Admin\AppData\Local\Temp\e9edc46e.exeC:\Users\Admin\AppData\Local\Temp\e9edc46e.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4108 -s 4124⤵
- Program crash
-
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 186573⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /End /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 186573⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 186573⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /End /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 186573⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /End /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 186573⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /End /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 186573⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /End /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 186573⤵
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /End /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 186573⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /End /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 186573⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /End /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 186573⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 186573⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /End /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /End /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 186573⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 186573⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /End /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 186573⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /End /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 186573⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /End /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 186573⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /End /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3888 -s 5322⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3888 -ip 38881⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k LocalService1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "c:\program files (x86)\windowspowershell\modules\optimizepdf_r_rhp..dll",kDJeZ2k12⤵
- Loads dropped DLL
- Checks processor information in registry
-
-
C:\Windows\TEMP\e9edc46e.exeC:\Windows\TEMP\e9edc46e.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4108 -ip 41081⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"chrome.exe" --no-first-run --no-default-browser-check --noerrdialogs --disable-crash-reporter --disable-backgrounding-occluded-windows --disable-background-timer-throttling --disable-extensions-http-throttling --disable-renderer-backgrounding --disable-audio-output --silent-launch --restore-last-session --elevated --profile-directory="Default"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff91ee54f50,0x7ff91ee54f60,0x7ff91ee54f702⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1720,2036017694883587474,843523336428004314,131072 --lang=en-US --service-sandbox-type=network --disable-audio-output --noerrdialogs --mojo-platform-channel-handle=1820 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1720,2036017694883587474,843523336428004314,131072 --noerrdialogs --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1744 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1720,2036017694883587474,843523336428004314,131072 --lang=en-US --service-sandbox-type=utility --disable-audio-output --noerrdialogs --mojo-platform-channel-handle=2424 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1720,2036017694883587474,843523336428004314,131072 --lang=en-US --service-sandbox-type=utility --disable-audio-output --noerrdialogs --mojo-platform-channel-handle=3564 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-background-timer-throttling --field-trial-handle=1720,2036017694883587474,843523336428004314,131072 --lang=en-US --noerrdialogs --disable-extensions-http-throttling --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3748 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-background-timer-throttling --field-trial-handle=1720,2036017694883587474,843523336428004314,131072 --lang=en-US --noerrdialogs --disable-extensions-http-throttling --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4180 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1720,2036017694883587474,843523336428004314,131072 --lang=en-US --service-sandbox-type=utility --disable-audio-output --noerrdialogs --mojo-platform-channel-handle=4032 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-background-timer-throttling --field-trial-handle=1720,2036017694883587474,843523336428004314,131072 --lang=en-US --noerrdialogs --disable-extensions-http-throttling --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3656 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1720,2036017694883587474,843523336428004314,131072 --lang=en-US --service-sandbox-type=utility --disable-audio-output --noerrdialogs --mojo-platform-channel-handle=4028 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-background-timer-throttling --field-trial-handle=1720,2036017694883587474,843523336428004314,131072 --disable-gpu-compositing --lang=en-US --noerrdialogs --disable-extensions-http-throttling --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1720,2036017694883587474,843523336428004314,131072 --lang=en-US --service-sandbox-type=utility --disable-audio-output --noerrdialogs --mojo-platform-channel-handle=4824 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1720,2036017694883587474,843523336428004314,131072 --lang=en-US --service-sandbox-type=utility --disable-audio-output --noerrdialogs --mojo-platform-channel-handle=5076 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1720,2036017694883587474,843523336428004314,131072 --lang=en-US --service-sandbox-type=none --disable-audio-output --noerrdialogs --mojo-platform-channel-handle=5164 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-background-timer-throttling --field-trial-handle=1720,2036017694883587474,843523336428004314,131072 --disable-gpu-compositing --lang=en-US --noerrdialogs --extension-process --disable-extensions-http-throttling --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1720,2036017694883587474,843523336428004314,131072 --lang=en-US --service-sandbox-type=utility --disable-audio-output --noerrdialogs --mojo-platform-channel-handle=5692 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1720,2036017694883587474,843523336428004314,131072 --lang=en-US --service-sandbox-type=utility --disable-audio-output --noerrdialogs --mojo-platform-channel-handle=5160 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1720,2036017694883587474,843523336428004314,131072 --lang=en-US --service-sandbox-type=utility --disable-audio-output --noerrdialogs --mojo-platform-channel-handle=5456 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1720,2036017694883587474,843523336428004314,131072 --lang=en-US --service-sandbox-type=utility --disable-audio-output --noerrdialogs --mojo-platform-channel-handle=5824 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1720,2036017694883587474,843523336428004314,131072 --lang=en-US --service-sandbox-type=none --disable-audio-output --noerrdialogs --mojo-platform-channel-handle=5728 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1720,2036017694883587474,843523336428004314,131072 --lang=en-US --service-sandbox-type=none --disable-audio-output --noerrdialogs --mojo-platform-channel-handle=1468 /prefetch:82⤵
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4596 -s 29082⤵
- Program crash
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 484 -p 4596 -ip 45961⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
OptimizePDF_R_RHP..dll
OptimizePDF_R_RHP..dll
Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-100_8wekyb3d8bbwe.xml
Uqioyhuair.tmp
background.png
telemetry.P-ARIA-af397ef28e484961ba48646a5d38cf54-77418283-d6f6-4a90-b0c8-37e0f5e7b087-7425.json
wlidsvcconfig.xml
settings.dat
settings.dat
LOG
data_0
f_000001
f_000002
f_000003
f_000004
f_000005
Cookies
000003.log
000003.log
Preferences
Preferences
CURRENT
LOG
Local State
C662.exe
C662.exe
Sdaaysrpyefiy.tmp
Sdaaysrpyefiy.tmp
e9edc46e.exe
e9edc46e.exe
e9edc46e.exe
e9edc46e.exe
optimizepdf_r_rhp..dll
memory/380-277-0x00000237209A0000-0x0000023720AE0000-memory.dmp
memory/380-281-0x000002371EF40000-0x000002371F1F5000-memory.dmp
memory/380-279-0x00000237209A0000-0x0000023720AE0000-memory.dmp
memory/380-283-0x000002371EF40000-0x000002371F1F5000-memory.dmp
memory/816-309-0x0000024092350000-0x0000024092605000-memory.dmp
memory/816-312-0x0000024092350000-0x0000024092605000-memory.dmp
memory/1068-228-0x000000000A4C0000-0x000000000A5EB000-memory.dmp
memory/1068-198-0x000000000A4C0000-0x000000000A5EB000-memory.dmp
memory/1068-191-0x000000000D7A7000-0x000000000D7B8000-memory.dmp
memory/1332-241-0x0000022A670B0000-0x0000022A67365000-memory.dmp
memory/1332-237-0x0000022A670B0000-0x0000022A67365000-memory.dmp
memory/1332-235-0x0000022A66F30000-0x0000022A67070000-memory.dmp
memory/1332-234-0x0000022A66F30000-0x0000022A67070000-memory.dmp
memory/1696-321-0x00000284E7F60000-0x00000284E8215000-memory.dmp
memory/1696-324-0x00000284E7F60000-0x00000284E8215000-memory.dmp
memory/2212-133-0x0000000000440000-0x0000000000540000-memory.dmp
memory/2212-136-0x0000000000400000-0x000000000043F000-memory.dmp
memory/2212-135-0x0000000000400000-0x000000000043F000-memory.dmp
memory/2212-134-0x0000000002170000-0x0000000002179000-memory.dmp
memory/2260-255-0x000001E9E0C30000-0x000001E9E0EE5000-memory.dmp
memory/2260-248-0x000001E9E2690000-0x000001E9E27D0000-memory.dmp
memory/2260-249-0x000001E9E2690000-0x000001E9E27D0000-memory.dmp
memory/2260-252-0x000001E9E0C30000-0x000001E9E0EE5000-memory.dmp
memory/2504-175-0x0000000000100000-0x00000000003A4000-memory.dmp
memory/2504-180-0x0000025295390000-0x0000025295645000-memory.dmp
memory/2504-173-0x0000025296E10000-0x0000025296F50000-memory.dmp
memory/2504-176-0x0000025295390000-0x0000025295645000-memory.dmp
memory/2504-172-0x0000025296E10000-0x0000025296F50000-memory.dmp
memory/2508-290-0x000001A81D430000-0x000001A81D570000-memory.dmp
memory/2508-293-0x000001A81D430000-0x000001A81D570000-memory.dmp
memory/2508-295-0x000001A81BB60000-0x000001A81BE15000-memory.dmp
memory/2508-292-0x000001A81BB60000-0x000001A81BE15000-memory.dmp
memory/3160-354-0x0000000000E00000-0x0000000001836000-memory.dmp
memory/3320-219-0x0000015D77E60000-0x0000015D77FA0000-memory.dmp
memory/3320-221-0x0000015D76590000-0x0000015D76845000-memory.dmp
memory/3320-218-0x0000015D77E60000-0x0000015D77FA0000-memory.dmp
memory/3320-226-0x0000015D76590000-0x0000015D76845000-memory.dmp
memory/3712-351-0x000001B18B840000-0x000001B18BAF5000-memory.dmp
memory/3736-263-0x000002D61C4D0000-0x000002D61C610000-memory.dmp
memory/3736-264-0x000002D61C4D0000-0x000002D61C610000-memory.dmp
memory/3736-266-0x000002D61AA70000-0x000002D61AD25000-memory.dmp
memory/3736-270-0x000002D61AA70000-0x000002D61AD25000-memory.dmp
memory/3888-144-0x00000000023A0000-0x00000000024CE000-memory.dmp
memory/3888-145-0x0000000000400000-0x0000000000530000-memory.dmp
memory/3888-143-0x00000000022AF000-0x0000000002397000-memory.dmp
memory/4008-211-0x000001D158D10000-0x000001D158FC5000-memory.dmp
memory/4008-204-0x000001D15A770000-0x000001D15A8B0000-memory.dmp
memory/4008-205-0x000001D15A770000-0x000001D15A8B0000-memory.dmp
memory/4008-207-0x000001D158D10000-0x000001D158FC5000-memory.dmp
memory/4108-193-0x0000000002390000-0x00000000024C5000-memory.dmp
memory/4108-192-0x000000000224E000-0x0000000002382000-memory.dmp
memory/4108-194-0x0000000000400000-0x000000000055F000-memory.dmp
memory/4252-337-0x0000015250130000-0x00000152503E5000-memory.dmp
memory/4252-339-0x0000015250130000-0x00000152503E5000-memory.dmp
memory/4372-280-0x00000000061F6000-0x00000000061F8000-memory.dmp
memory/4372-329-0x00000000061F6000-0x00000000061F8000-memory.dmp
memory/4372-258-0x0000000006150000-0x0000000006290000-memory.dmp
memory/4372-259-0x0000000006150000-0x0000000006290000-memory.dmp
memory/4372-260-0x0000000006150000-0x0000000006290000-memory.dmp
memory/4372-215-0x0000000006150000-0x0000000006290000-memory.dmp
memory/4372-261-0x0000000006150000-0x0000000006290000-memory.dmp
memory/4372-251-0x00000000061F6000-0x00000000061F8000-memory.dmp
memory/4372-220-0x00000000061F6000-0x00000000061F8000-memory.dmp
memory/4372-265-0x00000000061F6000-0x00000000061F8000-memory.dmp
memory/4372-250-0x00000000061F6000-0x00000000061F8000-memory.dmp
memory/4372-189-0x0000000006279000-0x000000000627B000-memory.dmp
memory/4372-222-0x0000000006279000-0x000000000627B000-memory.dmp
memory/4372-199-0x0000000006150000-0x0000000006290000-memory.dmp
memory/4372-200-0x0000000007A40000-0x0000000007B80000-memory.dmp
memory/4372-271-0x0000000006150000-0x0000000006290000-memory.dmp
memory/4372-272-0x0000000006150000-0x0000000006290000-memory.dmp
memory/4372-273-0x0000000006150000-0x0000000006290000-memory.dmp
memory/4372-275-0x0000000006150000-0x0000000006290000-memory.dmp
memory/4372-274-0x00000000061F6000-0x00000000061F8000-memory.dmp
memory/4372-213-0x0000000006150000-0x0000000006290000-memory.dmp
memory/4372-212-0x0000000006150000-0x0000000006290000-memory.dmp
memory/4372-185-0x0000000006150000-0x0000000006290000-memory.dmp
memory/4372-216-0x0000000006150000-0x0000000006290000-memory.dmp
memory/4372-184-0x0000000006150000-0x0000000006290000-memory.dmp
memory/4372-183-0x0000000006150000-0x0000000006290000-memory.dmp
memory/4372-182-0x0000000006150000-0x0000000006290000-memory.dmp
memory/4372-208-0x0000000006279000-0x000000000627B000-memory.dmp
memory/4372-285-0x0000000006150000-0x0000000006290000-memory.dmp
memory/4372-286-0x0000000006150000-0x0000000006290000-memory.dmp
memory/4372-287-0x0000000006150000-0x0000000006290000-memory.dmp
memory/4372-288-0x0000000006150000-0x0000000006290000-memory.dmp
memory/4372-246-0x0000000006150000-0x0000000006290000-memory.dmp
memory/4372-291-0x00000000061F6000-0x00000000061F8000-memory.dmp
memory/4372-174-0x0000000006279000-0x000000000627B000-memory.dmp
memory/4372-245-0x0000000006150000-0x0000000006290000-memory.dmp
memory/4372-244-0x0000000006150000-0x0000000006290000-memory.dmp
memory/4372-170-0x0000000006150000-0x0000000006290000-memory.dmp
memory/4372-243-0x0000000006150000-0x0000000006290000-memory.dmp
memory/4372-169-0x0000000006150000-0x0000000006290000-memory.dmp
memory/4372-168-0x0000000006150000-0x0000000006290000-memory.dmp
memory/4372-167-0x0000000006150000-0x0000000006290000-memory.dmp
memory/4372-229-0x0000000006150000-0x0000000006290000-memory.dmp
memory/4372-300-0x00000000061F6000-0x00000000061F8000-memory.dmp
memory/4372-301-0x0000000006150000-0x0000000006290000-memory.dmp
memory/4372-302-0x0000000006150000-0x0000000006290000-memory.dmp
memory/4372-303-0x0000000006150000-0x0000000006290000-memory.dmp
memory/4372-304-0x0000000006150000-0x0000000006290000-memory.dmp
memory/4372-230-0x0000000006150000-0x0000000006290000-memory.dmp
memory/4372-308-0x00000000061F6000-0x00000000061F8000-memory.dmp
memory/4372-231-0x0000000006150000-0x0000000006290000-memory.dmp
memory/4372-232-0x0000000006150000-0x0000000006290000-memory.dmp
memory/4372-311-0x00000000061F6000-0x00000000061F8000-memory.dmp
memory/4372-201-0x0000000006150000-0x0000000006290000-memory.dmp
memory/4372-340-0x000000000616D000-0x000000000616F000-memory.dmp
memory/4372-318-0x000000000616D000-0x000000000616F000-memory.dmp
memory/4372-206-0x00000000061F6000-0x00000000061F8000-memory.dmp
memory/4372-236-0x00000000061F6000-0x00000000061F8000-memory.dmp
memory/4372-153-0x0000000005410000-0x0000000005F65000-memory.dmp
memory/4372-149-0x0000000006150000-0x0000000006290000-memory.dmp
memory/4372-148-0x0000000006150000-0x0000000006290000-memory.dmp
memory/4372-202-0x0000000006150000-0x0000000006290000-memory.dmp
memory/4372-147-0x0000000005410000-0x0000000005F65000-memory.dmp
memory/4372-256-0x00000000061F6000-0x00000000061F8000-memory.dmp
memory/4420-162-0x0000000005460000-0x0000000005FB5000-memory.dmp
memory/4420-166-0x0000000005460000-0x0000000005FB5000-memory.dmp
memory/4880-188-0x000001B4EEDC0000-0x000001B4EEF00000-memory.dmp
memory/4880-187-0x000001B4EEDC0000-0x000001B4EEF00000-memory.dmp
memory/4880-190-0x000001B4ED360000-0x000001B4ED615000-memory.dmp
memory/4880-196-0x000001B4ED360000-0x000001B4ED615000-memory.dmp
memory/4928-197-0x0000000003B30000-0x0000000004685000-memory.dmp
memory/4928-154-0x0000000003B30000-0x0000000004685000-memory.dmp
memory/4928-155-0x0000000003B30000-0x0000000004685000-memory.dmp